Rhode Island Benefits Breach Reached 650,000 People, 59% of the State

Deloitte alerted Rhode Island on 13 December 2024 to malicious code in RIBridges, the system that manages eligibility for public benefits including Medicaid, SNAP, HealthSource RI and RI Works. Investigation found the attackers had access for around five months, reached 28 of the system’s 338 backend environments, and exfiltrated data on almost 650,000 applicants and recipients — around 59% of the state’s population.

State officials said the Brain Cipher operation reached the system through the RIBridges VPN using the credentials of a Deloitte employee. Rhode Island later finalised a $12 million settlement with Deloitte, and a separate class action settled at $6.3 million.

Medicaid and SNAP records identify people by their need for support. The data is not only personal, it is a statement about circumstances.

It is also a population with the least capacity to absorb identity fraud, the least time to spend on credit freezes, and no ability to take their business elsewhere. Eligibility for a state benefit is not a service anyone can shop for.

The route was a VPN login belonging to an employee of the systems integrator, used for roughly five months before anyone noticed.

Contractor accounts are granted by one organisation, used inside another, and reviewed by neither. We have recorded the same gap at the British Library, where a partner-facing terminal server without a second factor was the way in.

The $12 million from Deloitte to the state is unusual in this file set: an integrator paying the customer whose system it built and whose credentials were used.

It resolves the question between the two institutions. The 650,000 people whose records left are covered by the separate and much smaller class action, which is the usual ordering.