ANNAPOLIS, September 24 — Three patients are suing Luminis Health over an August ransomware attack that forced the Maryland nonprofit system to suspend normal patient care at part of its network, accusing the operator of leaving sensitive medical records exposed on an unencrypted server connected to the internet. The class action, filed on behalf of victims of the incident, centers on Anne Arundel Medical Center, described in the complaint as the primary target of the cyberattack.
According to the claims, patient data was fully exposed because it sat on a server that was never encrypted — and that database was allegedly linked to the internet, a configuration the plaintiffs say made the trove of records far easier for cybercriminals to reach than if it had been stored securely.
What the lawsuit alleges
In its reporting on the case, local NBC affiliate WBAL-TV 11 said the plaintiffs argue Luminis was not only reckless but willfully failed to protect patient data despite knowing about the vulnerability of the unencrypted server. Their core worry is identity fraud — that they, and others caught up in the breach, could spend years dealing with the fallout.
An expert from the University of Maryland, Baltimore’s Center for Cyber, Health and Hazard Strategies, who spoke with the outlet, said some of the claims made in the lawsuit are likely to be hard to prove. It is also alleged that a data trove from the incident was posted for sale on the dark web.
That claim has yet to be substantiated.
A system still recovering
Luminis has yet to send out notifications to impacted individuals, because the data breach is still under investigation. In its latest status update on Sept. 18, the system said its clinics and hospitals are open, but it is still recovering from the cyberattack. The scale of the exposure matters.
Between its network of clinics and hospitals, the group cares for 1.8 million patients annually. Assuming the lawsuit is not dismissed and is granted class action status, all victims will be eligible to sign on as members of the class.
For communities across the region, the case turns on a question that reaches well beyond one hospital campus — how carefully health systems guard the records that patients hand over at their most vulnerable moments. What to watch next: whether the court certifies the class, and when Luminis begins notifying the people whose data may have been caught up in the breach.
