Luminis Health

Summary

A cybersecurity incident has disrupted certain systems at Luminis Health, a health system operating facilities primarily in central Maryland and on the Eastern Shore. The incident, announced via a Facebook post, affected the organization's online patient portal, which was down shortly after the announcement. Despite the disruption, the health system stated that its priority remains providing safe, high-quality care to patients and expressed appreciation for the community's patience and understanding.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 1, 2026, Luminis Health, a health system operating primarily in central Maryland and on the Eastern Shore, publicly disclosed that it was experiencing a cybersecurity incident affecting certain systems across its organization. The disclosure was made through a Facebook post published around 6:45 p.m., as reported in local news coverage of the event. In its post, Luminis Health stated that its priority remained providing safe, high-quality care to its patients, and it acknowledged the concern the incident might cause for patients, families, and the surrounding community. The health system also expressed appreciation for the patience and understanding of those affected during the disruption. As of approximately 7:30 p.m. on the same Tuesday evening, Luminis Health's online patient portal was reported to be down, indicating that the cybersecurity incident had immediate, visible impacts on the organization's digital infrastructure and the services accessible to patients through its web platforms. The source article directs readers to the Baltimore Sun for the full story, but the available information centers on the initial disclosure and observable early effects of the incident.

Luminis Health operates two main hospitals as part of its network: Luminis Health Anne Arundel Medical Center, located in Annapolis in Anne Arundel County, and Luminis Health Doctors Community Medical Center, located in Lanham in Prince George's County. The announcement of the cybersecurity incident was tied to the organization's broader facilities, suggesting that the impact was organization-wide rather than isolated to a single location. The early reporting does not specify which particular systems were affected, nor does it detail the nature of the cyberattack, the vector of intrusion, or the identity of any threat actor involved. There is also no information in the source material about whether patient data was accessed or exfiltrated, whether the incident involved ransomware, or whether clinical operations were directly disrupted beyond the outage of the online portal. Luminis Health did not provide a timeline for restoration of services or additional technical details in the initial disclosure referenced by the news report.

The available source material captures only the opening phase of the incident, focusing on the public notification and the immediate downtime of the online portal. No details are provided regarding detection mechanisms, containment actions, involvement of law enforcement or third-party cybersecurity firms, or communications issued to staff or patients beyond the Facebook post referenced in the coverage. The reporting does not indicate whether appointments, procedures, or emergency services were affected at the two main hospitals or at any affiliated facilities within the Luminis Health network. As the incident was still unfolding at the time of the September 2, 2026 article date, the chronology presented here reflects the earliest confirmed events: the Tuesday evening Facebook disclosure, the simultaneous outage of the health system's online portal, and the organization's stated commitment to maintaining patient care during the disruption.

Sources

Sources available to members: 1 source.