Youth and Shelter Services, reports malware attack, data breach

Youth and Shelter Services, Inc., a nonprofit organization based in Ames, Iowa, is reporting a malware attack that was discovered in September 2023. YSS is a nonprofit organization founded in 1976 that provides support services to children, youth, and families in Iowa. Their services include mental health counseling, crisis intervention, addiction recovery, and housing support.

The incident involved unauthorized access to their computer network between September 3, 2023, and September 4, 2023, during which threat actors installed malware and potentially exfiltrated sensitive data.

The breach was caused by a malware attack that disrupted certain network functions. After detecting unusual activity within their network, YSS initiated several response actions, including notifying law enforcement and launching an investigation. The company formally reported a data breach on December 27, 2024.

The exposed sensitive information includes:

• Names
• Dates of birth
• Social Security numbers
• Driver's license numbers
• Financial account information
• Medical information
• Health insurance information
• Billing & claims information
• Passport numbers
• Other government-issued identification numbers

The exact number of affected individuals is not disclosed in the provided information. YSS sent notification letters to affected individuals on December 27, 2024