Mt. Baker Imaging was the target of a cyberattack in January and now faces a class action lawsuit. (Hailey Hoffman/Cascadia Daily News)
In early 2025, Mount Baker Imaging and Northwest Radiologists, two prominent medical imaging providers in Bellingham, Washington, experienced a significant data breach that has impacted the personal and medical information of over 348,000 Washington residents. This breach, which occurred between January 20 and January 25, was only publicly acknowledged in March 2025, and notifications to affected individuals were sent out months later in July.
If you or a loved one received medical services from Mount Baker Imaging or Northwest Radiologists, your sensitive data may have been compromised. Emery | Reddy, PC is here to help you understand your rights and explore your legal options.
What Happened?
The breach was initially described as a network disruption, but forensic investigations later confirmed unauthorized access to internal systems and data exfiltration. While the providers have not disclosed whether this was a ransomware attack or another form of cybercrime, the absence of a public claim by any extortion group leaves many questions unanswered.
The compromised data includes:
Full names
Addresses and phone numbers
Dates of birth
Email addresses
Social Security numbers
Driver’s license or state ID numbers
Medical diagnoses and treatment information
Provider names
Medical record and patient ID numbers
Health insurance details
Treatment cost information
This level of exposure puts individuals at risk for identity theft, medical fraud, and other forms of exploitation.
How Did the Providers Respond?
Mount Baker Imaging and Northwest Radiologists have stated that, as of their last update, there is no evidence of misuse of the stolen data. However, they have offered complimentary credit monitoring and identity theft protection services to affected individuals as a precaution.
They also engaged outside forensic specialists and reportedly worked with the FBI to investigate the breach. Despite these efforts, the delay in notifying patients and the lack of transparency about the nature of the attack have raised concerns among cybersecurity experts and legal professionals.
Legal Implications and Your Rights
Under HIPAA and Washington State law, healthcare providers are required to safeguard patient data and notify individuals promptly when breaches occur. The delay in notification and the scale of the breach may constitute violations of data protection laws, opening the door for legal action.
If you were affected, you may be eligible to pursue your own legal claim.
Contact Emery | Reddy Today
At Emery | Reddy, we protect Washington workers and consumers from corporate negligence and privacy violations. If your data was compromised in the Mount Baker Imaging data breach, we can help you understand your legal rights.
Our team is committed to holding healthcare providers accountable and ensuring that your privacy is respected. Call us today.
Whether you’ve been injured on the job, subjected to mistreatment in the workplace, or affected by a privacy breach, our expert attorneys are here to help.
"Very friendly interview and intake process. I was informed thoroughly about the processes in obtaining a lawyer and was given ample time to make a decision on representation. I’m thankful for everyone’s help and looking forward to working with this Firm on my worker’s compensation claim."
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.