Bellingham Healthcare Providers Propose $3.3M Settlement in 2025 Ransomware Breach A proposed class action settlement has been reached between Mt. Baker Imaging, LLC and Northwest Radiologists, Inc., P.S. and plaintiffs following a ransomware attack that exposed the sensitive data of approximately 340,000 individuals. The breach occurred between January 20 and 25, 2025, compromising personal and medical information, including names, Social Security numbers, dates of birth, addresses, health insurance details, and treatment records. Four lawsuits were filed in Whatcom County Superior Court after the incident, later consolidated in May 2025 and amended into a single complaint in June 2025. The plaintiffs alleged negligence, breach of implied contract, and violations of the Washington Consumer Protection Act. Under the proposed settlement, a $3.3 million non-reversionary fund will be established to cover: - Reimbursement for documented out-of-pocket losses (up to $5,000 per person) - Two years of Medical Shield Complete, a credit and medical monitoring service - Pro rata cash payments from any remaining balance Additionally, the defendants have agreed to invest over $500,000 in cybersecurity upgrades. A preliminary approval hearing is scheduled for April 17, 2026, after which affected individuals will have 90 days to submit claims, object, or opt out of the settlement.

In January 2024, hackers breached the systems of Northwest Radiologists / Mt. Baker Imaging (MBI), gaining unauthorized access to sensitive patient records of over 348,000 Washington residents. The compromised data included full names, Social Security numbers, diagnoses, treatments, addresses, driver’s license numbers, email addresses, phone numbers, and patient IDs. While the company claimed no evidence of misuse, the breach exposed highly sensitive medical and personally identifiable information (PII), posing long-term risks of identity theft, fraud, and emotional distress.The company delayed notifications for nearly 10 months, initially downplaying the incident as a 'computer network disruption' before admitting it was a data breach. A class-action lawsuit was filed in April 2024, alleging negligence and inadequate cybersecurity, violating state and federal laws. The breach’s scale and the nature of the stolen data—including medical histories and financial identifiers—heighten the severity, as such information is prime for exploitation in fraud, phishing, or blackmail. The company’s slow response and lack of transparency further exacerbated the fallout.