Cybercriminals who attacked Luminis Health might not have targeted patients\u2019 credit cards, Social Security numbers or other valuable information in its system. <\/p>\n
Instead, they likely wanted a more direct payday.<\/p>\n
Ransom.<\/p>\n
\u201cWhat they\u2019re looking for is leverage over an entity that can then potentially give them a big payout,\u201d said Nate Apathy, who studies hospital cyberattacks as an assistant professor at the University of Maryland School of Public Health. \u201c\u2018We\u2019ve crippled your system. Pay us however much Bitcoin,\u2019 or whatever, \u2018and we\u2019ll allow you to have your system back, and we won\u2019t do anything nefarious.\u2019\u201d<\/p>\n
It\u2019s been more than three weeks since Luminis, which operates Anne Arundel Medical Center in Annapolis, Doctors Community Hospital in Lanham and several outpatient centers, revealed it was the target of an \u201cincident.\u201d<\/p>\n
The not-for-profit hospital group\u2019s public statements have focused on efforts to restore its healthcare systems for its 1.8 million patients. By last week, emergency rooms were open, surgeries were going as scheduled, phones were working again and patient records were back, but only in \u201cread-only\u201d mode.<\/p>\n
Luminis hasn\u2019t detailed what happened or its response, so trying to figure out what happened involves looking at national patterns. If it was a ransomware attack, the disruption is a strong sign the company didn\u2019t pay. <\/p>\n
But it may never explain exactly what happened.<\/p>\n
Hospitals increasingly rely on outside software vendors to protect them from cybercriminals.<\/p>\n
\u201cThe vendors know that that\u2019s their whole business, right?\u201d Apathy said. \u201cIf they can\u2019t be credibly secure, then what business do they have selling a system to anyone?\u201d<\/p>\n
The attack appears to be different from a summer phishing campaign aimed at the electronic health record-keeping system Luminis uses, MyChart.<\/p>\n
After that attack, the app, sold by Epic Systems, locked out patients and providers at Luminis\u2019 hospitals, outpatient centers and affiliated medical practices across eight counties.<\/p>\n
MyChart warned customers about an increase in bogus emails asking users to log in using their passwords.<\/p>\n
\u201cSome might try to steal your login information or promise free gifts if you enter payment details,\u201d wrote Trevor Berceau, Luminis\u2019 research and development director, on the company website<\/a> in July. \u201cThe increase in attempts is due to scammers taking advantage of the popularity of the MyChart brand rather than any security concern, so you can continue to use MyChart as normal.\u201d<\/p>\n A week before the Aug. 31 attack on Luminis, Epic Systems updated its warning<\/a> with examples that seem aimed at patients rather than providers.<\/p>\n One phishing email was titled \u201cYour recent results are ready.\u201d Users were asked to enter a command to identify themselves, but the key combination secretly opened a coding window on the computer.<\/p>\n Epic spokesperson Coral Graszer declined to comment but pointed to public statements by the hospital and the software company. <\/p>\n But companies such as Epic have their own vulnerabilities, including reliance on other companies to develop parts of an app, store code or provide cloud data services that the various systems use to operate.<\/p>\n \u201cEvery transaction point is a potential point of failure,\u201d Apathy said.<\/p>\n The result, he said, is a daisy chain of potential openings. <\/p>\n In 2022, Oracle Health bought one of the pioneers of electronic health records, Cerner. Three years later, Oracle was still updating Cerner\u2019s software when hackers discovered compromised passwords and used them to break into the system.<\/p>\n The data breach exposed patient records at hospital systems nationwide, including LifeBridge Health in Baltimore. <\/p>\n \u201cYou go further up the chain and it gets even more centralized,\u201d Apathy said. \u201cAmazon Web Services is supplying the backend database architecture for hundreds, maybe thousands of health systems to run their cloud-based applications.\u201d<\/p>\n Just as IT system integration created vulnerabilities, Luminis\u2019 years of expansion spread the attack\u2019s impact beyond its two hospitals.<\/p>\n Anne Arundel Medical Center adopted the name Luminis Health in 2019, reflecting its acquisition of Doctors Community Hospital. Long before that, though, the system was buying up specialty medical practices, adding vertical healthcare services such as heart surgery and building outpatient centers and medical office buildings. <\/p>\n The result is a system deeply connected to medical practices, lab services and other healthcare providers \u2014 all of which were affected by the attack.<\/p>\n If the attack compromised individual records, Maryland law requires healthcare companies to notify patients whose data was exposed. Far harder to detect will be the impact on the healthcare itself.<\/p>\n Hannah Neprash, a professor at the University of Minnesota, led one of the first attempts to quantify harm to patients from hospital cyberattacks. She and her colleagues created a national database stretching back to 2016.<\/p>\n \u201cWe\u2019ve recently updated our data through 2025 and each year saw an increase in ransomware attacks on health care providers,\u201d she wrote in an email.<\/p>\n