RIBridges hack affected 108,000 unexpected residents, Neronha considering lawsuit against Deloitte

PROVIDENCE, R.I. (WLNE) — Months after a cyberattack on the RIBridges system that processes benefits for hundreds of thousands of Rhode Islanders, Governor Dan McKee revealed new details about the timing and scale of the hack Thursday.

The new information comes courtesy of an investigation from independent group CrowdStrike.

Though the public was notified of the data breach in December, the hacker group Brain Cipher actually first gained access to the data by impersonating a Deloitte representative in July.

Deloitte, the company that runs the system for the state, was not aware of the attack until it received an email from Brain Cipher demanding ransom.

“The evidence also shows that between July 3 and November 28, the threat actor browsed folders and files on 28 of the 330 RIBridges systems,” said Brian Tardiff, Rhode Island Chief Digital Officer.

“Between November 11 and

24, 397 large outbound transfer alerts to an external cloud storage provider were triggered in the RIBridges files, an indicator of files being taken.”

According to the governor, more than 644,000 Rhode Islanders’ data was involved in the attack.

Although 114,000 people that were originally notified that their data may have been compromised ended up not being included in the breach.

But almost 108,000 new people were included who could now have their data circulating on the dark web.

According to the governor’s office, some of the people in that new group never even used RIBridges, but were included in other files shared with federal agencies for verification purposes

Anyone that’s in the new group of Rhode Islanders impacted by the breach will get a letter, expected to arrive in the mail after Memorial Day.

A call center will be available for that batch of people to help them set up free credit monitoring.

Governor McKee said the state is working to move to a new benefits system, which will likely have a new vendor too.

He told ABC6 Thursday that Attorney General Peter Neronha is looking into filing a lawsuit against Deloitte.

“That this would be undetected for that period of time is something that is just unacceptable,” said Governor McKee.