Youth Development, Inc.

Summary

Youth Development, Inc., a New Mexico-based provider of community services including education and healthcare, experienced a data breach involving unauthorized access to sensitive personal information. The incident began with a cybersecurity intrusion that remained undetected until forensic investigators later confirmed potential exposure of member data, which included names, Social Security numbers, dates of birth, passport details, medical records, treatment information, insurance data, and student identification numbers. The organization publicly disclosed the breach nearly a year after the initial compromise, though specifics regarding the attack vector, discovery timeline, and total affected individuals were not released.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Youth Development, Inc. (YDI), a New Mexico-based agency providing early childhood education, mental health services, and career training programs, experienced a cybersecurity incident involving unauthorized access to personal data. The breach initiation date was identified as December 4, 2018, though YDI did not publicly disclose the event until November 26, 2019. Forensic investigators confirmed to YDI on October 2, 2019, that member information may have been compromised starting from the December 2018 intrusion date. The organization’s notice did not specify when internal detection of the breach occurred or the total number of affected individuals, leaving critical timeline and scope details unresolved.

Exposed information included highly sensitive personal identifiers such as full names, Social Security numbers, dates of birth, and passport numbers. Medical records were also compromised, encompassing treatment histories, medical record numbers, insurance details, and student identification card numbers. YDI did not attribute the breach to a specific attack vector in its public notice, though external analysis suggested phishing as a plausible cause. No evidence indicated whether data was exfiltrated, misused, or encrypted during the incident. The agency directed impacted parties to review its website for the full breach notification but did not describe remediation efforts beyond engaging forensic experts. Consequences centered on identity theft and medical privacy risks for an undisclosed population across YDI’s service programs in New Mexico.

Sources

Sources available to members: 1 source.