Patient Care Technician

Luminis cybersecurity incident highlights 'concerning' rise in attacks on healthcare. By Danielle J. Brown Maryland Matters September 9, 2026 Cyberattacks on the healthcare industry, like the one that hit an Anne Arundel County hospital last week, are becoming increasingly common and state-level policymakers should prepare for even more, an expert said Tuesday. "I think it's incumbent upon people who have influence over policy, especially at the state level, to start thinking about what the state can do to improve coordination, to improve readiness, to make sure that when the inevitable happens we are as prepared as we possibly can be," said Benjamin Yelin. He is the public policy and external affairs program director with the University of Maryland, Baltimore's Center for Cyber, Health and Hazard Strategies. His comments come just days after Luminis Health facilities last week announced a "cyber incident by an unauthorized criminal actor" that disrupted certain medical appointments and services. Luminis hospitals remained open while an investigation into the attack continues, but some of their systems were nonoperational, which could impact appointments and services. "As a result of the incident, certain systems are currently unavailable, which may affect some appointments and services. Our teams are working urgently to restore affected systems as quickly and safely as possible," the Luminis notice says. "Our top priority remains providing safe, high-quality care to our patients while responding to this incident," it said. "We understand the concern and inconvenience this disruption may cause, and we sincerely appreciate your understanding and patience with our teams." Luminis did not immediately respond to request for an update on the on the incident or the ongoing investigation. As of Tuesday, the health system's website still warns that patients may be facing disruptions in services due to the incident. But Luminis is just the latest example in what seems to be a rise in cybersecurity threats facing the healthcare industry. FBI data on reported ransomware attacks on "critical infrastructure" in 2025 shows that the healthcare industry was the largest target for ransomware that year, with 460 of 2,118 reported ransomware attacks targeting the the healthcare and public health sphere. "It's a threat that we have to take very seriously," Yelin said. "It's [the Luminis attack] adding to a series of disturbing incidents going back 10 years to the MedStar cyber incident." He's referring to a large ransomware attack in 2016 which included MedStar Health along with municipalities and public institutions across the United States. Attacks on the healthcare sphere have continued since. In 2021, the Maryland Department of Health and local departments faced a ransomware attack that disrupted operations for weeks. And in 2024, a ransomware attack on Ascension hospitals affected facilities in Baltimore. Hospitals and related entities like insurance companies are a favorite target among cybercriminals who find the sensitive and personal health information sheltered in those institutions and hold it for ransom, locking those types of healthcare institutions out of their own systems with a demand for payment. "Hospitals have this enhanced risk. Not only are they interconnected, but just the quality of the data they have makes them more attractive to cyber criminals," Yelin said. Meanwhile, direct interference in the technical infrastructure at hospitals, such as through a denial-of-service attack, can disrupt the medical care at hospitals, and can have ripple effects on other spokes of the healthcare industry. "Any downtime is potentially risking lives. Cybercriminals know that. They know the level of desperation that's so unique to these hospitals," Yelin said. "If there's any kind of delayed treatment, or if you're forcing medical staff to lose access to electronic health records... if there are are delays in lab results, if you can't see the interactions between drug medications, you're going to feel the impacts. "You can understand why this sector is so popular for cybercriminals," he said. Maryland Matters is part of States Newsroom, a network of news bureaus supported by grants and a coalition of donors as a 501(c)(3) public charity. Maryland Matters maintains editorial independence. Was this article valuable? Danielle J. Brown is a new Maryland resident covering health care and equity for Maryland Matters. Previously, she covered state education policy for three years at the Florida Phoenix, along with other topics such as abortion access and LGBTQ+ issues. Born and raised in Tallahassee, Florida, she is a 2018 graduate of Florida State University, where she served as an editorial intern for International Program's annual magazine. She has also contributed stories to Rowland Publishing and reviewed community theater productions for the Tallahassee Democrat. Interested in cyber? Get automatic alerts for this topic.

Cyber incidents hit millions of patients, disrupt hospital systems. A series of newly disclosed cyber incidents is affecting healthcare organizations across the U.S., exposing millions of patient records while also disrupting systems used to deliver care. Aesto Health has confirmed a breach affecting 9.54 million people and at least 30 healthcare provider clients, making it the second-largest confirmed healthcare data breach of 2026 to date. Hackers accessed Aesto's AWS environment and stole information that included SSNs, financial account information, medical histories, health records, insurance information and claims and billing data. Separately, Nutex Health, which operates 27 hospitals and outpatient facilities across 12 states, confirmed that attackers stole patient, employee and healthcare provider information along with confidential business and financial data. The attackers are now threatening to publish the stolen information. Meanwhile, Luminis Health is dealing with an active cyberattack that has made certain systems unavailable across its Maryland healthcare network, affecting access to some patient services. Damon Small, Board of Directors, Xcape, Inc.: "Three separate healthcare cybersecurity incidents in three weeks represent an alarming escalation that directly threatens patient care alongside data privacy. The disruption across Aesto Health, Nutex Health, and Luminis Health demonstrates that the operational risk extends far beyond exfiltrated protected health information (PHI) or regulatory fines. When cyber incidents cut off access to electronic health record (EHR) systems, clinical operations grind to a halt, delaying necessary care and risking patient safety. Healthcare providers have historically viewed IT systems as ancillary, underfunding them both operationally and fiscally. These recent events provide a definitive signal that clinical IT infrastructure is just as essential to positive patient outcomes as doctors, nurses, and medical machinery. To protect patient safety and maintain clinical continuity, healthcare executives must elevate IT security to a core operational priority, enforce strict third-party vendor risk controls, restrict network exposure, and maintain offline, immutable backups. "Critical Takeaways: * Clinical IT infrastructure directly affects patient care delivery, making its defense as vital to health outcomes as doctors, nurses, or medical equipment. * EHR downtime and business associate breaches create immediate operational paralysis that extends far beyond health record theft. * Health system leadership must stop treating IT as an ancillary back-office expense and fund operational technology security accordingly. "Treating hospital IT like an ancillary expense works right up until the emergency room is forced back to pen and paper." "I am deeply concerned that breaches of this scale and magnitude aren't even making it into mainstream media anymore. "If you go back ten years or so, something like this would have been front-page news. But these breaches have happened so frequently, and the story is essentially the same story repeated over and over again with a different organization's name attached to it, that I think a lot of media outlets simply don't want to run them anymore. People don't click on those articles like they used to. "And I think that's where the real danger is. "IT Nerd is becoming numb to breaches of this magnitude. Unless you're one of the people or organizations directly impacted, a massive cybersecurity breach barely registers on the radar for most Americans anymore. "That normalization should concern us. The breaches haven't become less serious. We've just become accustomed to them." Denis Calderone, CTO, Suzu Labs: "Healthcare as a sector is having a bad year. Luminis Health in Maryland is the most recent, with systems still down and patients calling a phone number instead of logging into MyChart. The Gentlemen ransomware group is threatening to publish stolen data from Nutex Health's 27 hospitals. Aesto Health had a breach back in December that took five months to confirm, and the number just landed on the HHS breach portal this week at 9.5 million patients across 30 providers. Two days ago it was McKesson and 284 million claimed records. DentaQuest already set the high mark for the year at 15 million. And this is just what's making headlines right now. "The legal and regulatory machinery is now moving as fast as the attacks. Nutex disclosed the breach to the SEC on August 24. A class action was filed in Texas three days later. That's before the company even finished determining what was stolen. The Aesto breach happened in December 2025, wasn't confirmed until May 2026, and is now the second-largest healthcare breach of the year at 9.5 million individuals. In April, HHS's Office for Civil Rights settled four separate ransomware investigations for a combined $1.165 million, and the root finding in every single one was the same: failure to conduct an adequate risk analysis. Data breach class action filings went from 604 in 2022 to nearly 1,500 in 2024, and healthcare is feeding that pipeline faster than any other sector. The window between breach disclosure and lawsuit has effectively collapsed. "The Gentlemen ransomware group went from emergence in mid-2025 to over 675 claimed attacks, with healthcare as their second most targeted sector. Aesto was breached in December, and confirmation didn't come until May. Meanwhile, the legal bar for what constitutes reasonable cybersecurity in healthcare is already set, and it's set by freely available government guidance. Plaintiffs' attorneys are citing HIPAA Security Rule requirements and published CISA recommendations to establish a standard of care in court. The proposed Security Rule update isn't creating new expectations. It's codifying what juries are already being told is the baseline. If your organization can't demonstrate its meeting that bar today, the breach is only the first problem." Healthcare is a sector that is targeted by hackers. Which means that if you are in healthcare, you need to defend yourself accordingly

Daily News Brief | September 2, 2026. Give Eye On Annapolis about fifteen minutes a day, and Eye On Annapolis will give you all the local news, local sports, local weather, and local events you can handle. Luminis Health is dealing with a cybersecurity incident after a day of major system problems, rabies has been confirmed in a bat in Annapolis and a raccoon in Millersville, the Annapolis Yacht Club may be getting into the marina business in a big way, and Anne Arundel County wants to know just how prepared you are for the next emergency. All that coming up on this morning's Daily News Brief. And with her weekly Annapolis After Dark, it's BeeprBuzz. The Eye On Annapolis Daily News Brief is produced every Monday through Friday at 6:00 am and available wherever you get your podcasts and also on its social media platforms-All Annapolis and Eye On Annapolis (FB) and @eyeonannapolis (TW) NOTE: For hearing-impaired subscribers, a full transcript is available on Eye On Annapolis Where to find the DNB... All content (C) 2026 Eye On Annapolis Good morning, it is Wednesday, September 2nd, 2026, and THIS is your Eye On Annapolis Daily News Brief presented by Annapolis Subaru, Covington Alsina, and the SPCA of Anne Arundel County. Here's some housekeeping! No DNB next Monday - it's Labor Day, and Eye On Annapolis is refusing to do any labor - manual or otherwise. You can find me on my couch! Boomer trivia! Which pugilistic Pulitzer Prize winner ran for Mayor of New York in 1969 promising to ban private cars from the City abd make New York City the 51st state? Was it Norman Mailer, Kurt Vonnegut, Tom Wolfe, or Hunter S. Thompson? Take a guess, and I'll have the answer for you in about five minutes! But now Eye On Annapolis has some news, so shall Eye On Annapolis? Luminis Health is responding to a cybersecurity incident that has knocked certain systems offline across the health system, affecting services including MyChart and potentially some appointments. Patients with upcoming appointments or scheduled services should call 443-222-0193 during business hours before arriving. Luminis says it is working with legal counsel and outside cybersecurity experts, but has not said whether patient information was accessed or when systems will be fully restored. The disclosure follows widespread system problems Monday that lasted much of the day, prompted some employees to be sent home and resulted in the hospital entering a Code Black. Luminis provided little information Monday and did not respond to an Eye On Annapolis request for details. It is still unclear whether Monday's problems were connected to the cybersecurity incident announced yesterday. The Anne Arundel County Department of Health is looking for anyone who may have had contact with two animals that tested positive for rabies on August 31. A bat was found at a business on State Circle in Annapolis, and a raccoon was found near West Pasadena Road and Drexel Drive in Millersville. Anyone who may have touched the animals, or whose pet may have had contact with them or has unexplained wounds, should call the Health Department at 410-222-7254 during business hours or 443-481-3140 after hours. Rabies is fatal without treatment, so anyone bitten or scratched by a potentially rabid animal should wash the wound immediately with soap and water and seek medical attention. After several days of rumors and Reddit chatter, Eye On Annapolis has confirmed that the Annapolis Yacht Club is considering buying the Annapolis City Marina - which, despite the name, is privately owned. AYC members have been called to a special meeting on September 14 at the Annapolis Waterfront Hotel to vote on purchasing the marina, fuel dock, and underground parking at the Eastport property. No purchase price or other terms were included in the membership notice. Annapolis City Marina has about 90 slips and sits at 410 Severn Avenue, very close to the Yacht Club's Sailing Center and other AYC facilities. The proposal also comes as large investment-backed companies have been buying up marinas around Annapolis and Anne Arundel County, and sadly, evicting many liveaboards to favor more transient boaters - who will pay a higher dollar. Safe Harbor acquired Port Annapolis and Eastport Yacht Center last year after Blackstone Infrastructure bought Safe Harbor for $5.65 billion, while Stella Marinas and Drake Real Estate Partners acquired South River Marina and Turkey Point Marina in Edgewater. If approved, the AYC deal would put another major local marina under new ownership - but will the marina remain public? That remains to be seen. September is National Preparedness Month, and the Anne Arundel County Office of Emergency Management is asking residents to do two things: take at least one step to get better prepared and complete a new Community Emergency Preparedness Survey. That preparedness step could be signing up for Alert Anne Arundel, putting together an emergency kit, creating a household plan, learning CPR or first aid, or simply talking with a neighbor about emergency needs. The survey is designed to help OEM understand how prepared residents feel, what gets in the way of being prepared, and what kinds of training, resources, and assistance people would like the county to offer. Participation is open to everyone, contact information is optional, and responses could help shape future emergency preparedness programs. Eye On Annapolis has the links at EyeOnAnnapolis.net, and Eye On Annapolis is planning to hop on a podcast with the County's Director of the Office of Emergency Management, Preeti Emrick, soon! Oh, and speaking of podcasts - bonus one dropping in a few hours (if you are listening at 6am) with Mike Kelly, the Director of Athletics at the Naval Academy! Be sure to give it a listen! OK, by now, you know the drill. Please let your friends, neighbors, and colleagues know about its Daily News Recap email. It's free, it comes to your inbox every night at 7 pm, and it will keep you up to speed on all the top LOCAL news stories, and it is paywall-free! Here's a link for you. Remember, its Local Business Spotlight podcast series is back, and its next episode drops at noon on Saturday. This week, Eye On Annapolis is talking Betty and the Bewtty Center. Not sure what that's all about? Tune in Saturday at noon! All right, let's put this puppy to bed with a quick thank you to you. Eye On Annapolis also thank its sponsors for this Daily News Brief: Annapolis Subaru, the SPCA of Anne Arundel County, Mac Medics, Covington Alsina, Third Eye Comics, and Hospice of the Chesapeake! As for the boomer trivia answer...apparently Norman Mailer was the candidate that promised that for New York... I need to read up on that. Learned something new today! So now, you need to hang tight; Eye On Annapolis has your Eye On Annapolis local Weather coming up with George Young. And, Bridgett, also known as Beepr Buzz, is here with Annapolis After Dark! All that is coming up in just a bit, so stick around.