Deloitte and RIBridges Data Breach Investigation

On December 13, 2024, Rhode Island State was informed by its vendor, Deloitte, that there was a major security threat to RIBridges, the system that manages many of the State’s social services programs.¹ Additionally, Deloitte confirmed that there is a high probability that a cybercriminal has obtained files with personally identifiable information.¹ As a result, Deloitte launched an investigation to determine the nature of the incident.

Through its investigation, Deloitte confirmed that any individual who has received or applied for state health coverage or health and human services programs or benefits in Rhode Island could have been impacted by this breach.¹ The programs and benefits managed through the RIBridges system include but are not limited to:

• Medicaid
• Supplemental Nutrition Assistance Program (SNAP)
• Temporary Assistance for Needy Families (TANF)
• Child Care Assistance Program (CCAP)
• Health coverage purchased through HealthSource RI
• Rhode Island Works (RIW)
• Long-Term Services and Supports (LTSS)
• General Public Assistance (GPA) Program
• At HOME Cost Share

Additionally, while the information impacted varies depending on the individual, the type of information potentially exposed includes:

• Name
• Social Security number
• Address
• Date of birth
• Banking information

Recently, the State of Rhode Island Department of Administration posted a notice of the incident on its website. Additionally, the State plans to mail individual breach notification letters affected individuals. Based on the website breach notice, the State is providing affected individuals with a list of the specific types of sensitive information impacted and complimentary credit monitoring. A link to the form breach notification that the State posted to its website is below.