Northwest Radiologists / Mount Baker Imaging Data Breach 2025: 362,713 Affected After January Ransomware Attack at Bellingham Radiology Group. $3.3M Settlement — Claims Due August 19, 2026. What To Do

Northwest Radiologists, Inc. and Mount Baker Imaging, the Bellingham-based radiology practice and its joint-venture outpatient imaging arm, filed a HIPAA breach notification with the HHS Office for Civil Rights on October 28, 2025, reporting 362,713 affected individuals in a Hacking/IT Incident at a Network Server. Forensic investigators and court settlement documents confirm this was a ransomware attack: an unauthorized actor accessed and exfiltrated files from the network between January 20 and January 25, 2025, with the network disruption identified on January 25. No specific ransomware group has publicly claimed responsibility. The exposed file set included Social Security numbers, driver’s license and state ID numbers, banking information, military ID numbers, dates of birth, health insurance details, and clinical information including diagnosis, treatment, and provider data. Individual notice letters did not arrive until October 31, 2025, roughly ten months after the intrusion. A $3.3 million class-action settlement received preliminary approval on April 21, 2026 — the claim deadline is August 19, 2026.

Timeline

• January 20-25, 2025 — Unauthorized actor accesses Northwest Radiologists / Mount Baker Imaging network; entity identifies a “computer network disruption” on January 25.
• March 26, 2025 — Entity posts an initial data-security-incident notice on the Mount Baker Imaging website; no individual letters are sent at this stage.
• April 25, 2025 — Daniel Uitdenhowen (Ferndale) and Michael Barr (Bellingham) file a proposed class action in Whatcom County Superior Court alleging negligence and inadequate security.
• May 2025 — Court consolidates four parallel class actions into a single proceeding.
• June 2025 — Plaintiffs file a consolidated complaint citing negligence, breach of implied contract, and violations of the Washington Consumer Protection Act.
• July 10, 2025 — Entity files notice with the Washington Attorney General reporting 348,118 affected Washington residents.
• October 28, 2025 — HHS OCR breach report submitted: 362,713 individuals, Hacking/IT Incident at Network Server (the final, higher count once non-Washington patients are included).
• October 31, 2025 — Notification letters mailed; President Stephen Buetow writes that the entity has “no reason to believe” data will be misused. Buetow declines to publicly explain the seven-month gap between discovery and AG notice, which Washington law requires within 30 days.
• April 21, 2026 — Judge Evan Jones of Whatcom County Superior Court grants preliminary approval of the $3.3 million settlement (In re: Mt. Baker Imaging, LLC, Data Security Litigation, Case No. 25-2-00463-37). Settlement administrator EAG Gulf Coast, LLC launches MtBakerDataSettlement.com.
• July 20, 2026 — Deadline to opt out of or object to the settlement.
• August 19, 2026 — Claim submission deadline (online at MtBakerDataSettlement.com or postmarked).
• August 21, 2026 — Final settlement approval hearing, 1:30 p.m. PT, Whatcom County Superior Court.

What was exposed

Per the Washington AG filing and the entity’s substitute notice, the compromised file set included:

• Identity data: full name, address, phone, email, date of birth.
• Government identifiers: Social Security number, driver’s license / Washington state ID number, military ID number.
• Financial data: banking and financial account information.
• Clinical and insurance data: health insurance policy and ID numbers, patient ID / medical record number, diagnosis, treatment, provider name, and treatment cost information.

The combination of SSN plus driver’s license plus financial account information puts most patients in the high-risk tier for synthetic identity fraud and account-takeover attempts, not just medical-identity misuse.

What the entity is offering

Northwest Radiologists / Mount Baker Imaging is providing complimentary credit-monitoring and identity-protection services to notified individuals and has set up a dedicated call center at 1-855-291-2706. The settlement adds two years of Medical Shield Complete medical identity-theft protection through CyEx for all class members who submit a valid claim. Written inquiries go to Northwest Radiologists / Mount Baker Imaging, 2930 Squalicum Parkway, Suite 101, Bellingham, WA 98225.

Class-action posture

The $3,300,000 non-reversionary settlement fund — preliminarily approved by Judge Evan Jones on April 21, 2026 — covers approximately 340,184 class members (U.S. residents whose private information was potentially or actually compromised in the January 2025 incident). The fund includes:

• Reimbursement of documented out-of-pocket losses up to $5,000 per class member (receipts, fraud charges, credit-monitoring costs, bank fees, notary charges, postage).
• Two years of Medical Shield Complete identity-theft protection through CyEx.
• Pro-rata cash payments from remaining fund balance after administration costs and attorney fees.
• Attorney fees not to exceed $1,100,000; service awards of $4,000 each for the nine named class representatives.

The consolidated complaint alleges negligence, breach of implied contract, and violations of the Washington Consumer Protection Act. The settlement covers four separately filed class actions that were consolidated into a single proceeding. Plaintiff-side firms publicly investigating or active in the litigation include Strauss Borrelli PLLC, Emery Reddy, PLLC, and Almeida Law Group.

Key deadlines:

• Opt-out or object: postmarked by July 20, 2026
• Submit a claim: online or postmarked by August 19, 2026 at MtBakerDataSettlement.com
• Final approval hearing: August 21, 2026, 1:30 p.m. PT, Whatcom County Superior Court

Claim submission options: Claims may be filed online at MtBakerDataSettlement.com or mailed to Mt. Baker Claims Administrator, P.O. Box 1711, Baton Rouge, LA 70821. Approved claimants can receive payment via Venmo, PayPal, Zelle, or paper check.

What to do

1. Submit a settlement claim by August 19, 2026. File online at MtBakerDataSettlement.com or mail a printed form postmarked by that date to: Mt. Baker Claims Administrator, P.O. Box 1711, Baton Rouge, LA 70821. You need the settlement claim ID from your notice letter. Approved payments can be received via Venmo, PayPal, Zelle, or paper check. Doing nothing forfeits your share of the $3.3 million fund.
2. Freeze your credit at Equifax, Experian, and TransUnion. With SSNs, driver’s licenses, and banking data in the exposed set, a freeze is the highest-leverage protection against new-account fraud. It is free and reversible.
3. Enroll in Medical Shield Complete through CyEx when you submit your claim. The two-year monitoring window begins when you activate.
4. File an IRS Identity Protection PIN request if your SSN was exposed. It is free at IRS.gov and blocks fraudulent tax-return filings in your name.
5. Review your insurance Explanation of Benefits for treatment you did not receive. Medical-identity misuse from radiology records can take 12-24 months to surface as fraudulent claims.
6. Monitor your banking accounts. Banking and financial account information was in the exposed file set. Set up transaction alerts and consider replacing compromised account numbers.
7. Stop the ongoing flow of your radiology and imaging data. HealthConsent files HIPAA restriction requests so the diagnostic, clinical, and insurance records exposed in this breach are not continuously re-shared across imaging networks, health information exchanges, and insurance data platforms.

Sources

• Washington Attorney General — Northwest Radiologists/MBI breach registry entry — the state filing of record (348,118 Washingtonians).
• Mt. Baker Imaging — Notification of Data Security Incident — the entity’s substitute notice.
• HIPAA Journal — Medical Imaging Provider Confirms Data Breach Affecting More Than 348,000 Patients — synthesis of data elements and credit-monitoring offer.
• SecurityWeek — Northwest Radiologists Data Breach Impacts 350,000 Washingtonians — confirms intrusion window and unattributed attacker.
• Cascadia Daily News — Mt. Baker Imaging notifies patients of data breach 10 months after incident — confirms October 31, 2025 letter date and Buetow statement.
• Cascadia Daily News — Lawsuit: Hackers stole thousands of patient records in cyberattack on Mt. Baker Imaging — class-action filing, named plaintiffs.
• Whatcom News — Bellingham businesses propose settlement in data breach class action suit — $3.3M fund terms and April 17, 2026 hearing.
• Radiology Business — Patients sue West Coast private radiology practice over recent cyber incident — trade-press coverage of the suit.