Luminis Health Suffered Cyberattack on September 4
The provider reported a digital security incident that continues to affect patient portal access across its facilities.
Updated on Sept. 22, 2026 in Cybersecurity
Live Poll
Do you trust your local healthcare providers to adequately protect your personal medical data?
Luminis Health sustained a cyberattack on September 4, 2026, prompting a class action lawsuit filed by patients over data protection concerns. While hospital telephone services have been restored at Anne Arundel Medical Center and Doctors Community Medical Center, online patient portals remain offline.
Why it matters
The breach impacts a health system serving over 1.8 million patients in Maryland, forcing a return to manual phone-based workflows for essential services. The legal action highlights the growing scrutiny regarding digital security standards in regional health networks.
Luminis Health serves a total population of 1.8 million patients in Maryland. Currently, hospital telephone systems are operational, while digital patient portal access remains suspended pending safety testing.
The players
Luminis Health
A health system providing care to over 1.8 million patients in Maryland through a network of hospitals and clinics.
Anne Arundel Medical Center
A medical facility within the Luminis Health network that has restored its telephone service capabilities.
Doctors Community Medical Center
A Lanham-based medical facility impacted by the security breach that has restored its phone lines.
The details
Technical teams are currently performing safety and quality validation tests on infrastructure before bringing systems back online. This restoration process requires isolating compromised segments of the network to ensure that patient records are handled within a secure, verified environment. Until these systems are validated, patients must continue using telephone communication for scheduling, prescription management, and accessing test results.
Timeline
September 4, 2026: Luminis Health was hit by a cyberattack.
September 10, 2026: The health system formally informed patients of the incident.
Week of September 14, 2026: Affected patients filed a class action lawsuit.
The Tech Race
This incident follows the legal pattern established by HIPAA Security Rule compliance litigation. The class action lawsuit marks a departure from standard administrative resolution, emphasizing patient-led litigation as a primary mechanism for enforcing data protection standards.
Patients currently unable to access online portals must contact hospital services via telephone for test results and scheduling. The provider has not announced a specific date for when these digital portals will return to service.
The takeaway
The ongoing restoration process highlights the operational risks inherent in centralized hospital network infrastructure. Patients should monitor the Luminis Health system status for updates on the return of patient portal functionality.
Further reading
For more context on regional digital threats, see the Cybersecurity section.
Source note: This article includes information reported by WYPR.
Live Poll
Do you trust your local healthcare providers to adequately protect your personal medical data?
