Mt. Spokane Pediatrics Data Breach: What the 29,410 Affected Patients Should Know

Posted on : May 9, 2026Posted By : Matthew Russell
Posted In : Class Actions

If you got a letter from Mt. Spokane Pediatrics dated around April 30, 2026, your name was on a list of 29,410 patients whose information was taken in a January ransomware attack. For many on that list, the affected patient is a child. The practical steps below matter more than the letter does — and most of them are free.

What happened

The Mt. Spokane Pediatrics data breach began on or around January 1, 2026, when an unauthorized party broke into the clinic’s network and removed files. The clinic says it caught the intrusion, contained it, and brought in outside forensic investigators. Two days later, a ransomware group operating under the LockBit 5.0 name claimed responsibility.

The forensic investigation took most of the next four months. On April 22, 2026, investigators confirmed what was in the stolen files. The clinic began mailing notices to affected patients on April 30 and reported the breach to the Washington Attorney General.

What was in the files

Per the clinic’s notice, the stolen files contained some combination of the following for each affected patient:

  • Full name and date of birth
  • Social Security number
  • Health insurance information and health plan beneficiary number
  • Medical treatment and diagnostic information
  • Medical record number or patient number
  • Dates of service

Not every notified person had every category exposed. Patients whose Social Security numbers were among the stolen data are being offered free credit monitoring through the clinic.

The clinic says it has no evidence of fraud tied to the incident as of the notification date. That’s a snapshot, not a guarantee. Stolen healthcare records often surface on dark-web marketplaces months or years after the breach itself, which is why the practical response matters even if nothing has happened yet.

Why pediatric breaches are worse than most

A child’s Social Security number is, from a thief’s perspective, cleaner than an adult’s. Kids don’t check their credit. Most parents don’t either, on a child’s behalf. A stolen child SSN can sit unused for ten or fifteen years and surface as a fraudulent credit account, an apartment lease, or a tax return that has to be untangled before the child can buy a car or apply for student aid.

That’s the practical reason this breach hits harder than a typical adult-data exposure of the same size. A meaningful share of the 29,410 affected here are minors, and the harm — if it materializes — won’t show up for years.

What to do this week

Freeze your child’s credit at all three bureaus. Equifax, Experian, and TransUnion will each let a parent place a security freeze on a minor’s file. It’s free. Do this even if you take no other step. A freeze blocks new accounts from being opened in the child’s name and is the single most effective protection against the long-tail risk of pediatric SSN theft.

Enroll in the credit monitoring the clinic offered. It’s free for affected individuals. Use the activation code in your letter. The clinic’s response line is 1-833-289-5228 if you misplaced the code or have questions about your specific exposure.Pull a credit report on your child directly from each bureau. Children should not have a credit file at all. If a report comes back showing one exists, that’s a flag worth investigating. The Identity Theft Resource Center has step-by-step instructions for minor credit checks.

Watch your insurance EOBs and tax filings. Medical identity theft shows up as treatment you didn’t receive billed to your plan. Tax-related identity theft shows up as a rejected return because someone filed first using the affected SSN. Both can trace back to a healthcare breach.

Save the notice letter. It’s your proof you were among the affected and it’s what triggers your standing if anything later requires legal action.

The Washington context

The Washington Attorney General’s 2025 data breach report flagged a pattern that put Mt. Spokane Pediatrics squarely inside the trend before its own breach happened. Breach notifications in the state exceeded Washington’s population for the second year running. Ransomware was the leading attack type. Three of the top five breaches involved healthcare entities.

Washington’s data breach notification law, RCW 19.255, requires entities holding personal information to notify affected residents and the attorney general when more than 500 Washingtonians are involved. Mt. Spokane Pediatrics appears to have followed the notice requirement on its face. Whether the underlying security practices met the legal standard of reasonableness is a separate question, and one that often gets sorted out only after litigation forces the question.

What kind of legal exposure these breaches create

Affected patients sometimes have claims under several Washington and federal theories. The Washington Consumer Protection Act (RCW 19.86) reaches unfair or deceptive practices, and inadequate data security has been litigated under that statute. Common-law negligence applies where a covered entity failed to maintain reasonable safeguards. HIPAA itself doesn’t create a private right of action, but its standards are often used as evidence of the duty of care in state-law claims.

Class actions in healthcare data breach cases have become routine over the past several years. They typically resolve with settlements that include extended credit monitoring, identity-restoration services, and cash payments tied to documented out-of-pocket losses. Recoveries vary widely depending on the size of the breach, the sensitivity of the data, and whether plaintiffs can show actual misuse.

Damages generally fall into two categories. Actual out-of-pocket losses cover things like fraudulent charges, the time cost of restoring identity, and any monitoring you have to pay for beyond what the breached entity provided. Statutory or contract-based recovery is available where state law allows.

When it’s worth talking to a lawyer

You don’t need an attorney to freeze a credit file or sign up for monitoring. Do those things first regardless.
A short consultation makes sense if any of these apply:

  • You’ve already noticed unauthorized accounts, charges, tax filings, or medical claims tied to an affected SSN
  • A child’s information was exposed and you want to understand long-term protections beyond the standard monitoring window
  • You want to know whether a class action has been filed, whether you’d be in the class, and how class settlements affect your individual rights
  • You’ve spent meaningful time or money responding to the breach already

Most consumer-protection and data-breach cases are handled on contingency, meaning no fee unless there’s a recovery. A first call costs nothing.

If you want a Washington firm to talk it through, Russell & Hill takes consultations from anyone affected by the Mt. Spokane Pediatrics breach. Call us, or use the contact form on this page, and we’ll walk through your specific situation.

About the Author
Matthew-Russell
Matthew Russell
Matthew Russell is a founding partner at Russell & Hill, PLLC, and practices 100% personal injury law. He is admitted to the Washington bar (2001) and Oregon bar (2014). He earned his J.D. from Hamline University School of Law and his undergraduate degree from Clemson University. Matthew is a member of the Washington State Bar Association and Oregon State Bar Association. Connect with him on LinkedIn.

Frequently Asked Questions About Personal Injury Cases

Why Is My Lawyer Taking So Long to Settle My Case In Washington?
Who Pays Medical Bills After a Car Accident If You Weren’t at Fault?
What to Do After a Car Accident?
How much does it cost to hire an injury lawyer?
What should I do if the insurance company gives me a settlement?
Will my case go to trial?
Can You Sue Lyft for an Accident? Washington Legal Rights
How to File a Car Accident Report in Everett?
What should I do immediately after an injury?
How long do I have to file an injury claim?
How to Assess if Your Situation Qualifies for a Personal Injury Claim
What damages can I get in an injury case?
Lawyers

Settlements

$1.15M

Settlement


Auto Accident

$870K

Settlement


Auto Accident

$550K

Settlement


Auto Accident

$875K

Settlement


Wrongful Death

$300K

Settlement


Auto Accident

$210K

Settlement


Slip & Fall

$200K

Settlement


Auto Accident

$180K

Settlement


Slip & Fall

Get your FREE case evaluation today

If you would like more information or would like to talk to us about how we could help you.

We’re Ready to Help!

Have questions or need personalized legal assistance? Reach out to us at info@russellandhill.com, and we’ll discuss how we can support you every step of the way.

Spokane

1212 North Washington St, Suite 132 Spokane, WA 99201

(800) 529-0842 Get Directions

Everett

3811-A Broadway Everett, WA 98201

(800) 529-0842 Get Directions

Vancouver

502 NE 72nd St Suite 208 Vancouver, WA 98665

(800) 529-0842 Get Directions

Marysville

9317 State Ave, Suite A-4 Marysville, WA 98270

(800) 529-0842 Get Directions

Spokane Valley

9212 E Montgomery Ave Suite 401-5, Spokane Valley, WA 99206

(800) 529-0842 Get Directions