Hospitals in Anne Arundel and Prince George’s counties hit with cyberattack

Two hospitals in Anne Arundel and Prince George’s counties are the latest in Maryland to be hit by a cybersecurity attack, according to their parent company.

Officials at Luminis Health, which operates Anne Arundel Medical Center in Annapolis and Doctors Community Medical Center in Lanham, said in a statement on Wednesday that after “identifying the incident we took immediate steps to address the situation and launched an investigation with the support of legal counsel and third-party cybersecurity experts.”

Jennifer Savina, a Luminis spokeswoman, said certain systems are unavailable but teams are working to restore them.

In the meantime, ambulances with noncritical patients once bound for emergency departments at Doctors and AAMC are being rerouted, according to a statewide monitoring system.

There was no timeline for hospital functions to return to normal, according to the state agency that operates the system.

The attack is one of a number of cybersecurity events experienced by healthcare systems in the state.

Two years ago, hackers struck Saint Agnes in Baltimore, part of the 140-hospital system operated by Ascension, a nonprofit Catholic system.

Nurses there said at the time that they lost access to electronically stored patient records and resorted to fax machines and manually maintained paper spreadsheets to ensure patient safety and health.

Luminis officials said their hospitals remain open.

“We understand the concern this incident may cause and sincerely appreciate the patience and understanding of our patients, families and community,” Savina said.

She said patients with questions about upcoming appointments or scheduled services should call 443-222-0193 during business hours for current information.

Officials from the Maryland Department of Emergency Management said Luminis alerted them on Monday that the system was having technology issues that resulted in ambulances being rerouted elsewhere. A day later, Luminis released a message to the public about the cyberattack.

Several agencies, including the departments of emergency management, health and information technology, have been meeting with Luminis leaders and others to assess the most critical needs and available support.

The attack remains under investigation, said Emma Ritter, a spokeswoman for the emergency management department.

Patients of Luminis Health should check the Luminis website for information on the situation regarding appointments and other updates.

Cybersecurity experts have said that the attacks aren’t unique to Luminis and continue to be a growing problem. But health systems are generally less equipped than banking systems, for example, to deal with them, they added. Cybercriminals are usually after patient financial and health information.

Patients might not be aware of the scope of the problem until they get a message from one of their providers or unsuccessfully seek to use their patient portals.

Earlier this year, the American Hospital Association reported that attacks against hospitals, health systems and third-party providers have been surging.

The Greater Baltimore Medical Center and Johns Hopkins Health System also have faced cyberattacks in Maryland in recent years. The Maryland Department of Health faced an attack in late 2021, affecting everything from COVID data tracking to Medicaid provider funding.

Another attack was aimed at a nationwide technology firm used broadly by health systems called Change Healthcare, owned by insurance giant UnitedHealth Group.