Luminis Health, the Maryland system that runs Anne Arundel Medical Center in Annapolis, first reported a cybersecurity incident on 1 September 2026. By 8 October it said systems were restored. The cause, the attack type and whether patient data was taken have not been stated in the sources we could fetch.
What is confirmed
Statements from Luminis itself, as published on its website and quoted by news outlets:
- It reported a cybersecurity incident on 1 September 2026 and said it "launched an investigation" on identifying it.
- It engaged legal counsel and outside cybersecurity experts, and said teams were working to "safely restore affected systems."
- A later notice described an "unauthorized criminal actor."
- Its website banner, last updated 8 October 2026, says systems have been restored, hospitals and practices are seeing patients, and some patient notes, lab results and imaging results from the downtime may not yet appear in the MyChart portal.
What is reported
- JEMS reported that emergency services rerouted some patients to nearby facilities because Anne Arundel Medical Center had limited availability. A county fire department spokesperson said the incident had "little impact on response times."
- Patients told the Capital Gazette that clinicians used paper charts, and that some imaging records could not be pulled up.
- Fox Baltimore reported canceled appointments and delayed test results more than a week in. It also repeated social media posts from people who said they were cancer patients with interrupted treatment. Those accounts were not verified by the outlet.
- Eye On Annapolis reported that Luminis paused payment plans while systems were offline and said it would reset them so patients are not penalized.
What is not known
- Whether this was ransomware. Luminis used the term "cybersecurity incident" and "unauthorized criminal actor." Ransomware appears only as a possibility raised by an outside expert.
- Whether any ransom was demanded or paid.
- Whether patient information was accessed or copied. Luminis said it will notify people if the investigation shows they are affected.
- How many people are affected, and how the attacker got in.
Under HIPAA, notification of affected individuals generally must happen within 60 days of discovery, so a notice could still come.
What to do now
- If you are a Luminis patient, check MyChart for results from September, and confirm any pending lab or imaging order with your clinic by phone.
- Do not trust unsolicited calls or texts about billing or records. Contact the number printed on your statement.
- If you run a clinic or hospital, test your downtime procedures this quarter: paper forms, printed medication lists, a phone tree that does not depend on your IT network.
- Decide in advance who may say "ransomware" in a public statement, and what you will say about data while the investigation is open.
How this could have been avoided
The cause has not been disclosed, so no one can say what would have stopped it. What the public facts do show is where the pain landed: clinical records and phones went down together. Offline copies of schedules and medication lists, separate communications channels, and a rehearsed diversion plan reduce the harm of any outage, whatever its cause.
Try it yourself
Write a one page postmortem for a two week outage of your main records system, using the template in the demo.
Click through it at your own pace, or open it full screen.
Quick check
Has Luminis confirmed a ransomware attack?
No. In the sources we found it has only said "cybersecurity incident" and "unauthorized criminal actor." Ransomware is speculation from outside experts.
Sources
- Luminis Health website, cybersecurity incident banner, updated 8 October 2026
- JEMS: Some patients rerouted amid MD hospital cybersecurity incident
- Fox Baltimore: Luminis Health cyberattack, patients still waiting for care
- Eye On Annapolis: Luminis Health says systems restored after cyberattack, October 2026
