Patients of Luminis Health file class action lawsuit following August cyberattack

Maryland-based Luminis Health is facing a class action lawsuit, filed by three patients representing victims of an August cyberattack that shut down normal patient care operations at part of the nonprofit health system.

In the complaint, Luminis is accused of being negligent in safeguarding sensitive patient data, which was accessed by hackers in what appears to be a ransomware attack affecting Anne Arundel Medical Center, the primary target of the cybersecurity incident.

If the claims made in the lawsuit are correct, patient data was fully exposed, because it was being stored on a server, unencrypted. That database was also allegedly connected to the Internet, allowing cybercriminals to access the trove of medical records more easily than if it was stored securely.

In reporting on the lawsuit, local NBC affiliate WBAL-TV 11 said the plaintiffs are arguing that Luminus was not only reckless but willfully failed to secure its patient data, despite knowing about the vulnerability of the unencrypted server.

The patients are concerned they, and others, could be victims of identity fraud.

An expert from the University of Maryland, Baltimore’s Center for Cyber, Health and Hazard Strategies, who spoke with the outlet, said some of the claims made in the lawsuit are likely to be hard to prove.

It’s also alleged that a data trove from the incident was posted for sale on the dark web, but that claim has yet to be substantiated.

Assuming the lawsuit is not dismissed and is granted class action status, all victims will be eligible to sign on as members of the class. Luminus has yet to send out notifications to impacted individuals, as the data breach is still being investigated.

In its latest status update on Sept. 18, Luminus said its clinics and hospitals are open, but it’s still recovering from the cyberattack. Between its network of clinics and hospitals, the group cares for 1.8 million patients annually. 

For more, read WBAL’s coverage at the link below.