HealthConsent
Active breach tracker Spokane and Spokane Valley, WA Disclosed April 30, 2026

Mt. Spokane Pediatrics Data Breach 2026 (LockBit 5.0): 32,021 Washington Pediatric Patients Exposed. Minors' SSNs at Risk. What To Do

Mt. Spokane Pediatrics, a pediatric practice with two clinics in North Spokane and Spokane Valley, Washington, disclosed in April 2026 a January 2026 LockBit 5.0 ransomware attack exposing names, Social Security numbers, dates of birth, diagnoses, and prescription information for 32,021 patients (29,410 Washington residents). 12 months Cyberscout monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Jan 1, 2026

Unauthorized intrusion; files exfiltrated

Jan 1, 2026

Breach detected

Jan 3, 2026

LockBit 5.0 lists Mt. Spokane Pediatrics on Tor leak site (20-day countdown)

Apr 22, 2026

Forensic investigation concludes; PHI confirmed in exfiltrated files

Apr 30, 2026

Filed with HHS OCR and Washington AG; consumer notification begins

Data exposed

01

High-risk identity

Enables financial + identity theft

Date of birth Social Security number

02

Health records

Don't expire and can't be reissued

Diagnoses Treatment information Prescription information Medical record number

03

Contact & insurance

Phishing + targeted scams

Full name Provider name Patient ID number Health plan beneficiary number Health insurance information Dates of service

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Markovits, Stock & DeMarco (publicly investigating) Russell & Hill (publicly investigating)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Mt. Spokane Pediatrics is an independent pediatric practice with two clinics in North Spokane and Spokane Valley, Washington. The patient base is overwhelmingly minor patients from birth through young adulthood.

On January 1, 2026, an unauthorized third party intruded into the clinic’s network and exfiltrated files containing PHI. Two days later, the LockBit 5.0 ransomware group listed mtspokanepediatrics.com on its Tor leak site with a 20-day publication deadline. The forensic investigation concluded on April 22, 2026 that PHI was in the exfiltrated files. Mt. Spokane Pediatrics filed with the Washington Attorney General and HHS Office for Civil Rights on April 30, 2026, confirming 32,021 affected (29,410 Washington residents). Consumer notification began the same day.

What was stolen

  • Full name, date of birth
  • Social Security number
  • Diagnoses, treatment information, prescription information
  • Provider name, medical record number, patient ID, health plan beneficiary number, health insurance information
  • Dates of service

The pediatric patient base means the majority of exposed SSNs belong to minors, an unusually high-value asset for synthetic-identity fraud since minors’ credit files are unmonitored for years.

What Mt. Spokane Pediatrics is offering

  • 12 months of single-bureau credit monitoring, credit report, and credit score via Cyberscout (TransUnion)
  • Dedicated response line: 1-833-289-5228 (Monday to Friday, 8 a.m. to 8 p.m. Eastern, available for 90 days)

What to do (parent / guardian)

  1. Freeze your child’s credit at all three bureaus. Each requires manual outreach with proof of guardianship.
  2. Enroll your child in Cyberscout using the activation code in your letter.
  3. Pull your child’s credit report at annualcreditreport.com. An existing file for a minor is a synthetic-identity-theft red flag.
  4. File IRS Form 14039 under your child’s SSN.
  5. Stop the ongoing flow of your child’s pediatric data. HealthConsent files HIPAA restriction requests on behalf of your minor child.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.