The funds will settle a class action lawsuit stemming from a 2025 data breach.

 

What happened

Washington Gastroenterology (WAGI), a gastroenterology specialist center with 19 locations in Washington state, recently agreed to a legal settlement stemming from a class action suit filed over a 2025 data breach.

The lawsuit, In re Washington Gastroenterology, PLLC Data Breach Litigation, was a consolidation of multiple lawsuits that primarily claimed that data breach could have been presented and was the result of multiple security failures. The lawsuit also claimed that WAGI was negligent, in breach of their implied contract, and violated multiple Washington privacy laws, including the Washington Data Breach Notification Disclosure Law, among other allegations.

WAGI maintained that they did not participate in any wrongdoing, but have agreed to a settlement of $4.6 million to avoid litigation. The lawsuit is currently pending in the Superior Court of Washington and a final fairness hearing is scheduled for January 29th, 2027.

 

The backstory

According to WAGI’s data breach notice, issued on August 22nd, 2025, the breach was first discovered on March 10th, 2025, when WAGI said that data was “accessed and exposed by an unknown third party. The organization noted that they began initially sending notices on May 23rd, 2025, but the investigation was still ongoing. They then began sending additional notices in late August. Data involved included names, Social Security numbers, and medical information.

 

In the know

While it remains unconfirmed, according to Ransomware Live, which tracks ransomware gang activity, the attack was carried out by the malicious group INC. The group claimed WAGI in early 2025, posting some screenshots of the leak.

According to Paubox’s analysis, INC (also tracked as GOLD IONIC), was first observed in July of 2023. The group has members who are Russian-speaking, but it’s unclear if the group has any ties to the government. The group has now claimed approximately 983 victims, with potentially more that have not been named. INC Ransomware has also been known for double-extortion attempts, where data is both encrypted so that healthcare facilities can’t operate and stolen for ransom, as well as selling their ransomware services in Ransomware-as-a-Service schemes. One of the group’s largest attacks took place in 2024, when the threat group attacked McLaren Health Care Corp, resulting in a $14 million settlement.

 

The big picture

Data breaches and the financial ramifications can have extreme effects on a healthcare organization’s financial health. For an organization like WAGI, with 19 locations, it’s likely that they will recover, but it’s also possible that they may reduce locations or find other ways to reduce their budgeting costs. The financial health of these organizations has a direct impact on patients; according to the Association of American Medical Colleges, patient wait times for specialty clinics has increased 48% since 2004, with shortages predicted to increase even in metropolitan areas, as clinics close or because of the lack of doctors. In fact, while it’s uncommon for ransomware attacks to cause hospitals to close, it’s far from impossible. These closures impact hospitals, but the biggest impact is felt by patients, who may no longer be able to quickly receive the care they need.

 

FAQs

What is the Washington Data Breach Notification Disclosure Law and do other states have a similar law?

This law is similar to HIPAA’s data breach notification law, but has an even stricter, 30-day timeline requirement. Under this law, organizations operating in Washington must notify victims when their data is accessed. The law applies to healthcare and non-healthcare related organizations. Many other states do have similar laws, but Washington has one of the more stricter timelines. Most other states allow notifications to be provided within a 45 or 60 day window.

 

Could WAGI face any other legal issues?

It’s possible that WAGI could be investigated by the state, if the state also agrees that WAGI may have violated various laws. However, since there is no current investigation, it appears unlikely that the Washington Attorney General is pursuing the issue. As far as class action lawsuits, individuals would have to object to the current settlement and pursue a new claim with distinct arguments, which is generally unlikely to happen.