East King County, Washington-based mental health counselling centre, Youth Eastside Services, said a data security incident it suffered earlier this year compromised the sensitive personal information of its patients and staff.
Youth Eastside Services (YES) is a mental health counselling and substance use treatment centre. Located in Bellevue, Kirkland, and Redmond, the non-profit organisation has more than 50 schools and community centres in the Bellevue and Lake Washington school districts.
In a data breach notification, the healthcare provider said that on November 13, it detected suspicious activity within its internal network. it immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.
“Our investigation determined that some of our computer systems were accessed by an unknown actor and on November 13-14 certain files were accessed and/or exfiltrated without authorisation from our systems.
“YES is currently conducting a detailed review of records stored in the impacted files to determine what information is affected and to whom the information relates. This review is ongoing. However, on December 3, 2024 YES confirmed that certain information related to current and former employees, donors, and patients was impacted,” reads the notice.
The compromised data included names, medical record identification numbers, dates of birth, addresses, demographic information, diagnosis, clinical documentation, claim information, insurance information, and service & appointment dates.
YES has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.
Recently, the INC ransomware group claimed responsibility for the cyber attack on the counselling centre’s systems and listed it as a victim on its data leak site. The group claims to be in possession of confidential data stolen from the organisation and has shared sample screenshots to prove the authenticity of its claims.
