Hospital breach sparks lawsuit

An Anne Arundel Medical Center patient sued Luminis Health after a September 4 cyberattack exposed personal medical information. Two other Anne Arundel County residents have joined the lawsuit seeking class action status.

Unencrypted data left vulnerable

The lawsuit alleges Luminis stored patient data in an unencrypted, internet-accessible environment, making it easy for attackers to access. The breach may have put tens of thousands of patients at risk.

Patients face lifelong risks

Plaintiff Jokisha White says the breach puts her and others at risk of fraud and health privacy violations that could last their entire lives. The lawsuit seeks at least 10 years of credit monitoring and monetary damages.

“intrusion of their health privacy”

Hospital systems still recovering

More than two weeks after the attack, Luminis phone lines just came back online and its patient portal MyChart remains offline. The company has provided limited details about what systems were affected or what data was compromised.

Proving harm is the challenge

Legal experts say patients often struggle to win these cases because they must prove actual harm, not just theoretical future risk. Without demonstrating concrete damage, lawsuits can be dismissed.

“If we can't point to an actual harm as plaintiffs, then we have a hard time establishing standing”

Hospitals are prime targets

Healthcare systems face constant cyberattacks because attackers know lives are at stake, giving them leverage to demand ransom payments. A 2025 report found 77 percent of surveyed healthcare providers had been hit by ransomware.

“If the attackers can identify an organization that truly isn't resilient and able to recover quickly, it's just extra pressure on them to extract a payment.”

Recovery time signals severity

Most hospitals return to normal within a week of an attack, but Luminis is still recovering after more than two weeks. This extended timeline suggests the breach was particularly serious and difficult to resolve.

“Sometimes it's a telling sign of how bad it is.”

Federal regulators may investigate

Beyond patient lawsuits, the Department of Health and Human Services can enforce HIPAA regulations and impose severe penalties on healthcare providers that fail to protect patient information. Luminis could face regulatory enforcement action.