2024–2026 Deloitte / RIBridges (Rhode Island) — ~644–700k residents; Brain Cipher; Apr 2026 $7M settlement
Data compromised
Resident PII in benefit system scope per public summaries—fields vary by person
Technical writeup
Rhode Island’s RIBridges public-benefits and eligibility platform, implemented with Deloitte as a key vendor, suffered a protracted incident publicly tied to a July 2024 intrusion attributed in state-facing reporting to the “Brain Cipher” criminal group and compromised Deloitte-side credentials. State summaries and class-action style coverage described personal information for on the order of 644,000–700,000 individuals. In April 2026, Rhode Island and news outlets (e.g., Rhode Island Current, Providence Business News, local NBC affiliates) publicized a further ~$7 million settlement layer atop earlier financial and remediation arrangements, with Deloitte also committing additional services; agreements were framed as resolution of disputed claims without admission of liability. This entry links vendor accountability, state benefit-system exposure, and the 2026 regulatory headline.
Root cause
Criminal intrusion via compromised vendor credentials and backend access paths (per state and press narratives)
References
- https://rhodeislandcurrent.com/2026/04/24/state-announces-7-million-settlement-with-contractor-deloitte-over-ribridges-cyber-breach/
- https://pbn.com/deloitte-to-pay-state-additional-7m-for-ribridges-cybersecurity-breach/
- https://turnto10.com/news/local/rhode-island-finalizes-multimillion-dollar-settlement-with-deloitte-after-data-breach-ribridges-taxpayers-agreement-cyberattack-april-24-2026