Lake Washington Vascular Data Breach
The 2025 Lake Washington Vascular data breach followed unauthorized access to the healthcare provider's network and the installation of malware.
Exposed Data Types
4 sensitive8- Health insurance information
- Medical information
- Diagnoses
- Treatment information
- Names
- Dates of birth
- Physical addresses
- Government issued IDs
About This Breach
According to the organization's statement, its technology team detected the attack shortly before 5:00 a.m. on February 14, 2025 and stopped the unauthorized access.
Lake Washington Vascular is a Washington healthcare practice focused on the diagnosis and treatment of vascular conditions.
When did the breach occur?
The official statement says the intruder accessed the network and installed malware on February 14, 2025. The malware encrypted the electronic medical record and practice-management systems; the organization restored them from offline backups. The incident was reported to the U.S. Department of Health and Human Services on February 25.
What information may have been affected?
The organization could not determine exactly what information the intruder viewed or removed. The affected systems contained names, dates of birth, addresses, payer identification numbers, government-issued identification, diagnostic test results, medical histories, diagnoses and treatment information. Not every data field was necessarily involved for every person.
The statement specifically said that credit-card and banking information was not stored in these systems.
How many people were affected?
The U.S. Department of Health and Human Services breach record reports 21,534 affected people.
What should affected people do?
Notice recipients should review health-insurance explanations of benefits, patient-portal activity and credit reports for unfamiliar services or transactions. Before responding to an unexpected call or message requesting identity or health information, verify the request through the provider's confirmed contact channels.
If suspicious activity appears, contact the relevant healthcare provider, insurer and, where appropriate, credit bureau directly. Use unique passwords and enable multi-factor authentication wherever it is available.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
