In January 2025, Northwest Radiologists, Inc. and Mount Baker Imaging experienced a data breach. Unauthorized third-party access to Mount Baker Imaging's network occurred between January 20-25, 2025. This incident was publicly acknowledged in March 2025, and notification letters were sent to affected individuals starting in July 2025, approximately six months after the breach.
The breach exposed personal data for an estimated 348,118 individuals in Washington. Exposed data types included names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers (SSNs), driver's license numbers, state ID numbers, medical diagnoses, treatment costs, provider names, medical record numbers, patient ID numbers, and health insurance policy numbers. Financial/banking information was also noted as potentially exposed in one source. The company states there is no reason to believe the information has been or will be misused.
This incident is considered a third-party business associate breach under HIPAA. Regulatory notification to the Washington Attorney General occurred on July 10, 2025. Litigation commenced with a class action lawsuit filed in April 2025, alleging negligence, breach of contract, privacy invasion, and violations of the Washington Consumer Protection Act, Data Breach Notification Law, and My Health My Data Act. A $3.3 million class action settlement was preliminarily approved in April 2026, offering cash and data monitoring to approximately 340,184 class members.