Mt. Baker Imaging Settlement Awards Up to $3.3 Million for 2025 Data Breach

Mt. Baker Imaging LLC and Northwest Radiologists Inc. disclosed a January 2025 ransomware incident that potentially affected about 340,184 people, including exposure of patients’ sensitive information such as personally identifiable information (PII) and protected health information (PHI). Because ransomware can encrypt or steal data and then prompt fraud or identity theft attempts, healthcare organizations are expected to protect electronic records with safeguards such as access controls, encryption, monitoring, and incident response procedures. In response to the breach, a class action lawsuit was brought on behalf of affected individuals residing in the U.S. whose data may have been compromised between Jan. 20 and Jan. 25, 2025. The parties agreed to settle for up to $3.3 million, with claims potentially offering up to $5,000 in reimbursable out-of-pocket losses (for example, unreimbursed fraud or identity theft costs and certain monitoring or contacting expenses), plus a pro rata cash payment and the option of two years of medical identity protection and monitoring. The lawsuit is significant because it centers on alleged failures to implement and maintain “reasonable” cybersecurity measures—issues that have become common in modern litigation as patients and consumers increasingly rely on electronic health systems. Similar cases have been filed across the healthcare industry after ransomware and data intrusions, reflecting growing claims that insufficient cybersecurity leads to downstream harms even when no direct misuse is proven at the time of breach disclosure. Industry context matters: healthcare entities typically must comply with HIPAA and its Security Rule, and they are also expected to follow evolving cybersecurity standards that regulators and courts often view through the lens of “reasonable safeguards.” Courts frequently treat settlement payments as a way to compensate for data-breach-related expenses and to avoid lengthy trials, while also sending a market signal about the importance of robust protections and rapid response. Here, eligible individuals can file claims online or by mail by Aug. 19, 2026 to potentially receive benefits from the settlement fund, which will be distributed after the final approval hearing and processing, underscoring how cybersecurity expectations in healthcare now extend beyond IT teams to legal and regulatory risk management as well.