Luminis Health Care cyberattack class-action lawsuit claims unencrypted patient data exposed at AAMC

September 17, 2026 - 18:09

Three patients have filed a class-action lawsuit against Luminis Health Care, alleging the health system failed to protect sensitive medical information during a recent cybersecurity incident. The complaint claims that unencrypted patient data was exposed at Anne Arundel Medical Center, leaving thousands of individuals vulnerable to identity theft and fraud.

According to court documents, the plaintiffs argue that Luminis Health Care neglected to implement adequate security measures, such as encryption and multi-factor authentication, that could have prevented unauthorized access. The lawsuit further alleges that the health system delayed notifying affected patients, reducing their ability to take protective action.

The breach reportedly compromised names, addresses, Social Security numbers, and medical records. The plaintiffs are seeking damages on behalf of all patients whose information was exposed, along with improved security protocols and credit monitoring services.

Luminis Health Care has not publicly commented on the pending litigation. Cybersecurity experts note that health care providers remain prime targets for ransomware and data theft because of the high value of medical records on black markets. The case highlights growing legal pressure on hospitals and health systems to safeguard patient data under federal and state privacy laws.