The Lawyers Moved Faster Than the Company

A proposed class action lawsuit has been filed in federal court in Seattle against a radiology group that has not confirmed the data breach the lawsuit alleges happened. The entire claim rests on something a ransomware gang posted on its own website. That is the odd part.

The group is Radia Inc., P.S., the largest 100 percent physician-owned and managed radiology group in the United States. It has roughly 200 board-certified radiologists, serves over 50 hospital and clinic partners across Washington and Idaho, and is based in Lynnwood, Washington. It is privately held, which means none of this plays out on a ticker. The downside is absorbed entirely by the doctors who own the place.

On July 16, a ransomware group called Chaos listed Radia on its data leak site - a dark web page where the group posts the names of organizations it claims to have breached. Chaos said it had obtained 655 gigabytes of data from Radia's networks. The types of data it listed include Social Security numbers, medical record numbers, diagnostic imaging reports, full medical billing records, corporate financial records, legal documents, and human resources files. The number of affected individuals has not been disclosed.

Radia has not confirmed the breach. It has not reported it to state attorney general offices. As of August 3, lawyers say this silence alone may violate federal or state disclosure laws.

That timeline - hackers post a claim, lawyers file a class action eight days later, and the company says nothing - is where the story actually lives. This is not primarily a cybersecurity article. It is a disclosure-timing article. In healthcare data breaches, legal liability doesn't hinge on whether the attack was clever. It hinges on the gap between when a company learns about the incident and when it is required to tell regulators and affected people. The lawyers' case, in a rough sense, doesn't need Radia to admit the breach happened. It just needs Radia to have known about it and waited too long to say anything.

So what is Chaos, and why does its claim matter even if the company hasn't verified it?

Chaos is a ransomware-as-a-service operation. That is basically a franchise model for extortion: the group develops the malware and runs the infrastructure, then recruits affiliates who carry out the actual intrusions in exchange for a cut of the ransom. Chaos emerged in February 2025, shortly after law enforcement disrupted a rival gang's operations in a campaign called Operation Checkmate. Cisco Talos, a security research firm, assessed with moderate confidence that the group was likely formed by former members of the BlackSuit gang.

The group uses "double extortion" - encrypting the victim's files and also stealing data to threaten public release if the ransom isn't paid. More recently it has layered on "triple" and even "quadruple" extortion, adding threats of denial-of-service attacks and promises to contact the victim's customers and competitors. Typical ransom demands are around $300,000. As of late March 2026, Chaos had claimed 36 victims, mostly in the United States.

The economic point is that Chaos is running a business whose revenue comes from the gap between the victim's pain and the cost of the ransom. The leak site is a sales tool, not a news service. It lists targets who haven't paid, and the countdown timers are designed to pressure negotiation. The claim against Radia could be genuine - it could also be a bluff or a premature listing. From the company's perspective, the rational move is to verify internally before confirming publicly. From the lawyers' perspective, the rational move is to file quickly, before the statute of limitations on the notification deadline starts ticking in the company's favor.

The class action, filed in the Western District of Washington on or around July 24, alleges that Radia failed to protect patient data from exposure. The complaint doesn't need to prove the breach was catastrophic. It needs to establish that if the breach happened, Radia's security was insufficient and its notification was late. Those are two separate claims with different legal standards. The security claim asks whether a reasonable healthcare provider would have prevented the intrusion. The notification claim asks whether the company waited too long to tell anyone. You can lose on notification even if you did everything right on defense.

There's a structural wrinkle in the name that most readers will skip past. The "P.S." in Radia Inc., P.S. stands for "professional service" - a Washington state corporate structure used by licensed professionals, including physicians. The point of the P.S. form is to limit the malpractice liability of individual doctors while keeping the group owned by the professionals themselves. In a neat way, the corporate wrapper that exists to protect the doctors' personal assets is now the entity named in the lawsuit. The doctors own the upside of the radiology practice and, contractually, they also own the downside of whatever happens next.

Healthcare has been the most heavily targeted sector for ransomware this year. Industry trackers reported 122 attacks in the first quarter of 2026 and 125 in the second. The incentive for the attackers is obvious: healthcare organizations hold sensitive patient data that is legally protected under HIPAA (the Health Insurance Portability and Accountability Act), face regulatory penalties if they don't report breaches promptly, and can't easily shut down their systems because people are waiting for diagnostic services. The leverage is life-critical, which makes the cost of the ransom look small in comparison.

What's unusual here is how fast the legal machinery started moving. The Chaos leak post went up on July 16. Monitoring services like DeXpose.io flagged it the same day. Class action lawyers announced their investigation on July 17. The proposed complaint landed in federal court by July 24. Radia, meanwhile, has made no public statement. I haven't been able to find one.

That silence is the central tension. If the breach is confirmed, the notification clock in Washington state - and under HIPAA at the federal level - starts running. For breaches affecting more than 500 people, HIPAA requires notification without unreasonable delay and in no case later than 60 days after the covered entity discovers the breach. Under the newer HITECH reauthorization rules that took effect in 2024, breaches affecting more than 500 people also require direct notification to the Secretary of HHS within 30 days. Radia serves over 50 clinics, so the affected-population threshold is not a theoretical concern.

If the breach turns out to be smaller than claimed, or if Chaos's listing was premature, the company's silence is more defensible. But the lawyers' strategy doesn't depend on Chaos being right about the data volume. It depends on Radia knowing about the claim and being required to investigate - and the clock starting from the moment of discovery, not from the moment of confirmation. The simplest model is that the notification deadline runs from when the company should have known, not from when it chose to say it knew.

The bottom line is structural, not technical. Ransomware gangs like Chaos have turned the healthcare disclosure timeline into part of the extortion mechanism: the faster the company has to notify regulators and patients, the more pressure there is to settle quietly. The lawyers, in turn, have turned that same timeline into a class action trigger: the longer the company stays silent after the claim surfaces, the more exposure it has on the notification front. And the physicians who own Radia are stuck in the middle, weighing an unverified dark web claim against regulatory deadlines that are already counting down whether they acknowledge the clock or not.

In a funny way, the leak site is doing the company's compliance work for it. The question is whether the lawyers have already done it faster.