Youth Eastside Services breach exposed mental health client records in Washington

Youth Eastside Services, a nonprofit in Bellevue, Washington that provides mental health and substance use counseling to children, young people and families in East King County, detected suspicious activity on its network on November 13, 2024.

Its investigation determined that certain computer systems had been accessed by an unknown actor and that files were accessed or exfiltrated on November 13 and 14. On or around December 3, 2024 it determined that information relating to Washington residents was likely impacted, and it told the Washington attorney general that the investigation into the matter was ongoing. In its notice to affected individuals the organization listed names, medical record identification numbers, dates of birth, addresses, demographic information, diagnosis, clinical documentation, claim information, insurance information and service and appointment dates. Comparitech and teiss reported that current and former employees and donors were affected alongside clients.

Youth Eastside Services first notified the Washington State Office of the Attorney General on December 20, 2024. In a supplemental filing dated February 5, 2025, its outside counsel said the organization had mailed notices that day to approximately 755 Washington residents. The letters offered credit monitoring and identity restoration services through Experian, with an enrollment deadline of May 30, 2025.

The organization said it engaged third-party cybersecurity specialists, implemented additional security measures, and was not aware of any actual or attempted identity theft or fraud connected to the event. The INC ransomware group claimed responsibility in late December 2024, a claim Youth Eastside Services did not confirm.