Radiology practice agrees to $3M settlement in class-action lawsuit over cyberattack
A radiology group has agreed to settle a class action lawsuit filed by patients following a data breach that occurred in early 2025.
Bellingham, Washington-based Northwest Radiologists and the related Mount Baker Imaging recently agreed to a proposed $3.3 million settlement for the ransomware attack. The figure is a consolidation of four separate lawsuits stemming from the attack.
Affected individuals stand to pocket up to $5,000 each to cover any out-of-pocket losses they may have incurred because of the breach. Patients also can choose to receive payment from a pro rata fund, which will be disbursed from what is left of the settlement after all other payments, including attorney fees, are distributed. These payments could reach up to $4,000, but the amount will vary depending on a number of factors. Patients also can claim two years of medical data protection and monitoring.
The practice first noticed a network disruption on Jan. 25, 2025. It immediately sought the services of forensic experts to determine the source of the disruption, which eventually led to the discovery of leaked data. It is estimated that personal information from 350,000 patients, including Social Security numbers and medical diagnoses, was exposed during the attack.
One of the initial lawsuits claimed that the practice’s security precautions were “completely inadequate” and allowed cybercriminals to access a “treasure trove” of personal data of thousands of people. After the breach, patients expressed frustration with how the practice communicated what had occurred, with attorneys accusing Northwest Radiologists of obfuscating the specifics. Plaintiff attorneys also criticized the timing of communications, claiming the practice did not disclose details quickly enough.
The settlement agreement protects the practice from fault of liability. The final hearing is set for mid-August.
