Home Industries Law Deloitte agrees to settle class-action lawsuits over RIBridges cyberattack

Deloitte agrees to settle class-action lawsuits over RIBridges cyberattack

By

Katie Castellani

-

09/11/2025

BZhglprV-Statehouse-drone — DELOITTE CONSULTING LLP, which is contracted to manage the RI Bridges system that was hacked last year, has agreed to settle several class-action lawsuits filed by people whose data was stolen./PBN FILE PHOTO/PAM BHATIA

PROVIDENCE – Deloitte Consulting LLP, which is contracted to manage the RIBridges system that was hacked last year, has agreed to settle several class-action lawsuits filed by people whose data was stolen. Several cases were consolidated into one and after going through mediation, the parties agreed “in principle on the material terms of the settlement”

Already a Subscriber? Log in

To Continue Reading This Article

Become a Providence Business News subscriber and get immediate access to all of our premier content and much more.

Learn More and Become a Subscriber

Critical RI business news and analysis updated daily.
1 year of print (26 issues).
Unlimited access to all subscriber only content on our website, on any device.
Free email alerts.
Annual Book of Lists Print Edition.
All special issues produced during subscription term.

Click Here to purchase a paywall bypass link for this article

PBN Branded Content

Inspiring the Next Generation of Scientists in Rhode Island

AP Biology students at Cumberland High School recently conducted a hands-on lab experiment using professional-grade…

Learn More

No posts to display

LEAVE A REPLY Cancel reply

PROVIDENCE – Deloitte Consulting LLP, which is contracted to manage the RIBridges system that was hacked last year, has agreed to settle several class-action lawsuits filed by people whose data was stolen. Several cases were consolidated into one and after going through mediation, the parties agreed “in principle on the material terms of the settlement” to resolve the case, according to court documents filed Aug. 25. Details of the settlement still need to be finalized and approved by a judge. On Sept. 5, the judge granted the parties request to extend a stay of the lawsuit until the settlement gains final approval. It was estimated that 650,000 people had their personal data stolen during the RIBridges data breach in December 2024. Deloitte, which has a $99 million state contract to manage RIBridges, provided $5 million in February to cover the expenses of about 2,000 HealthSource RI customers who were enrolled directly in coverage for January and February 2025. The consulting firm also agreed to cover the cost of a call center set up for the data breach, credit monitoring and identity protection for affected customers. RIBridges is used to administer the state’s government assistance programs including enrolled in SNAP, Medicare, Temporary Assistance for Needy Families, and those who purchase healthcare through the state administered HealthSource RI. The information leaked in the breach, stolen by ransomware group Brain Cypher, included Social Security and bank account numbers, along with information from health insurance received through HealthSourceRI. Some of that information was released on the dark web. Brain Cipher first infiltrated the RI Bridges system in July 2024 through a Deloitte employee’s VPN account – months before the breach was found, according to an investigation by cybersecurity firm CrowdStrike released in May. During a briefing when the investigations’ findings were released, Gov. Daniel J. McKee said his administration is preparing a Request for Proposals for the next vendor to manage the RI Bridges system, expected to be released within the next 18 months. McKee also said the administration is still pursuing available options and “avenues to ensure accountability.” Complaints filed in the U.S. District Court in Rhode Island said the plaintiffs and “thousands of class members suffered … financial losses resulting from identity theft, out-of-pocket expenses” and other costs. Also, that Deloitte disregarded the class members and plaintiffs by “...intentionally, willfully, recklessly, or negligently failing to implement adequate and reasonable measures to protect its data systems against unauthorized intrusions.” Deloitte also failed to take “reasonably available” steps to prevent the data breach and did not offer those affected with “prompt and accurate” notice of the breach, according to court documents. Another class action lawsuit over the cyberattack filed in U.S. District Court in New York, where Deloitte is headquartered, was dismissed in April, according to court documents. Karen Walsh, a spokesperson for Deloitte, as well as attorneys representing the class members did not immediately respond to PBN’s request for comment. McKee’s office also did not respond to PBN’s questions. Katie Castellani is a PBN staff writer. You may contact her at Castellani@PBN.com.