Mt. Baker Imaging
Mt. Baker Imaging cyberattack disrupts imaging services
Summary
A January 2025 cyberattack disrupted Mt. Baker Imaging and Northwest Radiologists’ network, phones and imaging work, requiring rescheduling and regional alternatives. Later notices confirmed unauthorized data access; a civil settlement received final approval in August 2026.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Scheduling disruption
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
-
Healthcare operations disrupted
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Third-party service disruption
The incident materially affected services delivered by or through a vendor, managed service provider, contractor, partner, or other third party.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
A cyberattack disrupted Mt. Baker Imaging and Northwest Radiologists’ network and medical imaging work in January 2025. The companies’ original March 26 notice confirmed unauthorized access to data. A later patient notice placed that access between Jan. 20 and Jan. 25; the network disruption was discovered around Jan. 25.
Operational significance
In Cascadia Daily News’ Jan. 28 interviews, the providers described rescheduling patients, while PeaceHealth confirmed effects at ambulatory facilities. Imaging remained available at St. Joseph Medical Center in Bellingham, United General Medical Center in Sedro-Woolley and Peace Island Medical Center in Friday Harbor. Some phone service was disrupted. These were continuity arrangements within a regional interruption, rather than evidence that every hospital stopped imaging.
KGMI’s Jan. 29 report described continuing efforts to minimize patient interruptions. Neither the later breach-review process nor litigation establishes how long the operational limitations lasted. The exact final restoration date remains unknown.
Confidence and uncertainty
Cyberattack confidence is high because the providers confirmed unauthorized access. Their patient notice described potentially affected identity, contact, medical, insurance and billing information, varying by person. It reported no reason to believe information had been misused at the time of notice.
The Washington attorney general’s entry, reported July 10, lists 348,118 affected Washington residents. This is a state resident count, not a verified total for every patient served.
The settlement agreement characterizes the event as ransomware involving data exfiltration. That supports a reported ransomware assessment, but the agreement expressly disclaims factual admissions and liability. The providers’ original notice confirms access without independently establishing encryption or the full extent of any copying. No responsible group has been verified.
A Whatcom County Superior Court order filed and signed Aug. 21, 2026 granted final approval to the settlement. The agreement established a $3.3 million non-reversionary fund. That fund is a civil settlement, rather than a ransom payment or a measured operational loss; approval does not establish wrongdoing.
Analytic gaps
The initial entry route, precise restoration date, encryption details and ransom or payment outcome remain unverified. Population figures in regulator and settlement materials differ and cannot be reconciled from the reviewed evidence. Operational status is presumed resolved based on the elapsed time since the last documented service disruption.
Organizations involved
Impacted location
Bellingham, Washington
Bellingham contains Mt. Baker Imaging’s verified Squalicum Parkway clinical/correspondence site. Source reporting establishes network and imaging-work disruption at the providers; this municipality anchor does not assert that every Bellingham facility or resident was affected.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.