Home Economy Government Deloitte could pay $6.3M in proposed settlement of RIBridges class action lawsuit

Deloitte could pay $6.3M in proposed settlement of RIBridges class action lawsuit

By

Katie Castellani

-

10/17/2025

BZhglprV-Statehouse-drone — DELOITTE CONSULTING LLP., which is contracted to manage the RIBridges system that was hacked last year, could have to pay $6.3 million to settle several class action lawsuits over the breach./PBN FILE PHOTO/PAM BHATIA

PROVIDENCE – Deloitte Consulting LLP, which is contracted to manage the RIBridges system which was hacked last year, could have to pay $6.3 million to settle several class action lawsuits over the breach. There are 735,501 class members that could receive up to $5,000 and credit monitoring from the settlement if it is approved by

Already a Subscriber? Log in

To Continue Reading This Article

Become a Providence Business News subscriber and get immediate access to all of our premier content and much more.

Learn More and Become a Subscriber

Critical RI business news and analysis updated daily.
1 year of print (26 issues).
Unlimited access to all subscriber only content on our website, on any device.
Free email alerts.
Annual Book of Lists Print Edition.
All special issues produced during subscription term.

Click Here to purchase a paywall bypass link for this article

PBN Branded Content

Webster Bank Celebrates 90 Years

By Samuel Hanna, Executive Managing Director, Commercial Real Estate, Webster Bank This year, Webster Bank…

Learn More

No posts to display

LEAVE A REPLY Cancel reply

PROVIDENCE – Deloitte Consulting LLP, which is contracted to manage the RIBridges system which was hacked last year, could have to pay $6.3 million to settle several class action lawsuits over the breach. There are 735,501 class members that could receive up to $5,000 and credit monitoring from the settlement if it is approved by the court, according to the proposal filed Thursday. The proposal comes after the parties went through negotiations and agreed to settle the case. While Deloitte has agreed to settle, it is doing so without admitting “liability or wrongdoing,” according to court documents. An estimated 650,000 people had their personal data stolen during the RIBridges data breach in December 2024. Deloitte, which has a $99 million state contract to manage RIBridges, provided $5 million in February to cover the expenses of about 2,000 HealthSource RI customers who were enrolled directly in coverage for January and February 2025. The consulting firm also agreed to cover the cost of a call center set up for the data breach, credit monitoring and identity protection for affected customers. RIBridges is used to administer the state’s government assistance programs including SNAP, Medicare, Temporary Assistance for Needy Families and those who purchase healthcare through the state administered HealthSource RI. The information leaked in the breach, stolen by ransomware group Brain Cypher, included Social Security and bank account numbers, along with information from health insurance received through HealthSourceRI. Some of that information was released on the dark web. Brain Cipher first infiltrated the RI Bridges system in July 2024 through a Deloitte employee’s VPN account – months before the breach was found, according to an investigation by cybersecurity firm CrowdStrike released in May. During a briefing when the investigations’ findings were released, Gov. Daniel J. McKee said his administration is preparing a Request for Proposals for the next vendor to manage the RI Bridges system, expected to be released within the next 18 months. Complaints filed in the U.S. District Court in Rhode Island said the plaintiffs and “thousands of class members suffered … financial losses resulting from identity theft, out-of-pocket expenses” and other costs. Also, that Deloitte disregarded the class members and plaintiffs by “…intentionally, willfully, recklessly, or negligently failing to implement adequate and reasonable measures to protect its data systems against unauthorized intrusions.” Deloitte also failed to take “reasonably available” steps to prevent the data breach and did not offer those affected with “prompt and accurate” notice of the breach, according to court documents. If the settlement gets court approval, class members can choose from two cash payment options: provide documentation to receive up to $5,000 or receive $100 without having to show any documentation of losses. If a class member doesn’t show documentation supporting a loss or if their claim is rejected then they will receive $100, according to the proposed settlement. Along with the payments, class members can also make a claim for medical data monitoring that includes two years of CyEx’s medical data monitoring. This includes real time credit monitoring, dark web scanning with immediate notification of unauthorized use, help with security freezing, victim assistance, $1 million in identity theft insurance with no deductible and access to fraud resolution agents to help investigate and solve cases of identity theft. If the court grants preliminary approval of the settlement, Deloitte has 10 days to provide the settlement administrator and attorneys representing the class with recipients’ names and addresses. Within 21 days of preliminary approval Deloitte has to put $500,000, which counts toward the $6.3 million, into an escrow account to cover settlement administration costs. Then, within 30 days of preliminary approval, Deloitte has to send a postcard to class members, which includes deadline dates as well as a settlement website and long form notice. Karen Walsh, a spokesperson for Deloitte, declined to comment on the proposed settlement. Representatives for class members did not immediately respond to PBN’s request for comment. Katie Castellani is a PBN staff writer. You may contact her at Castellani@PBN.com.