Hundreds of thousands in Rhode Island could be impacted by massive cybersecurity breach

Governor Dan McKee, joined by members of his Administration, hosted a media announcement with an hour’s notice on Friday night at 7:30 p.m. regarding a cybersecurity breach of the RIBridges system.  See video, below.

Background

On December 13, 2024, the State was informed by its vendor, Deloitte, that there was a major security threat to the RIBridges system. In response, we have proactively taken the system offline so that the State and Deloitte can work to address the threat and restore the system as quickly as possible. Additionally, Deloitte confirmed that there is a high probability that a cybercriminal has obtained files with personally identifiable information from RIBridges. 

RIBridges has nothing to do with EZPass or tolls, it is the moniker for the state’s software system “bridge” to services.

Information for Customers  

We understand this is an alarming situation for our customers. Current customers will not be able to log into their account through the portal or the mobile app while the system is offline. Updates will be made available at https://admin.ri.gov/ribridges-alert 

Rhode Islanders seeking to apply for benefits can still submit a paper application. 

Details about the Threat  

On December 5, the State was informed by its vendor, Deloitte, that the RIBridges data system was the target of a potential cyberattack. At that time, it was unclear if any sensitive information was breached. At that time, appropriate federal law enforcement and agencies were notified, as well as the Rhode Island State Police. 

After consultation with our state IT department, Deloitte immediately implemented additional security measures and started to assess the threat. It was important, for security reasons, to keep this knowledge internal until we could secure the RIBridges system. At the same time, our team began an investigation into what data may have been compromised, and how a possible attack was able to occur.  

On December 10, the State received confirmation from Deloitte that there had been a breach of the RIBridges system based on a screenshot of file folders sent by the hacker to Deloitte. On December 11, Deloitte confirmed that there is a high probability that the implicated folders contain personal identifiable data from RIBridges. On December 13, Deloitte confirmed there was malicious code present in the system, and the State directed Deloitte to shut RIBridges down to remediate the threat. State police and federal law enforcement are involved in an advisory capacity and no further leads have been provided.

Details about the Data Breach 

To the best of our knowledge, any individual who has received or applied for health coverage and/or health and human services programs or benefits could be impacted by this leak. The programs and benefits managed through the RIBridges system include but are not limited to:  

• Medicaid  
• Supplemental Nutrition Assistance Program (SNAP)    
• Temporary Assistance for Needy Families (TANF)  
• Child Care Assistance Program (CCAP)   
• Health coverage purchased through HealthSource RI   
• Rhode Island Works (RIW)    
• Long-Term Services and Supports (LTSS) and   
• General Public Assistance (GPA) Program  

While the analysis of the breach is still underway, unfortunately, Deloitte has indicated that the information involved may include names, addresses, dates of birth and Social Security numbers, as well as certain banking information, but is still assessing the situation.   

Households that may have had personal information compromised will receive a letter by mail from the State that explains how to access free credit monitoring.

However, there are steps you can take now if you know you applied for, or receive any of the above programs: Freeze your credit, place a fraud alert through major credit bureaus, change passwords, ask your bank what you can do, etc.

A dedicated call center for impacted customers will be available Sunday, December 15 from 11 a.m. to 8 p.m. After Sunday, the call center will be open Mondays through Fridays from 9 a.m. to 9 p.m. EDT. The State will update its website with the call center number on Sunday morning. 

We are currently unaware of any identity theft or fraud related to this data breach. However, we advise customers to remain vigilant and monitor their accounts for any unauthorized activity. This includes: 

• Taking steps to freeze credit and/or place a fraud alert through the three major credit bureaus (Visit https://www.usa.gov/credit-freeze for more information and see contact information for the three credit bureaus below). 
• As a best practice, customers should change any common or reused passwords to a new strong and unique one. Using a safe and secure password manager is the most effective way to reduce risks of password misuse. 
• Customers can also call their bank to ask what steps may be taken related to the security of their bank account.  

We will continue to provide updates as we receive them. Please visit our website for the latest information: https://admin.ri.gov/ribridges-alert.   

The Governor responded to a question saying hundreds of thousands of Rhode Islanders are potentially impacted. He also agreed that the old UHIP problems may be similar to what is happening now. Health insurance payments can be made at any CVS or at the HealthSource office in East Providence. December benefits – such as SNAP balances, etc. – have already been applies. The January DHS programs are “hoped” to be on the regular cycle. For new applications, paper applications will be necessary, and there may be a delay in benefits. This is not a ransomeware attack – “more of an extortion attempt”.

Watch the entire press event, HERE:

___

Attorney General Neronha offers information on how to protect yourself following a data breach

In response to the news of a major cyberattack on the Rhode Island State government, Attorney General Peter F. Neronha wants Rhode Islanders to have the information they need to protect themselves following a data breach. Data breaches can lead to identity theft, which is a serious crime that occurs when someone accesses your personal protected information such as your Social Security number, credit or bank account information or other identifying information without your permission. 

For information about this specific incident, visit RIBridges Alert | RI Department of Administration.

What to know here:

As required by law, affected consumers will receive notice within 30 days of discovery of the breach and the ability to provide the following information to affected consumers:

• A general and brief description of the incident, including how the security breach occurred and the number of affected individuals;
• The type of information that was subject to the breach;
• The date of breach, estimated date of breach, or the date range within which the breach occurred; and
• The date that the breach was discovered.

If you are (or think you may be) a victim of identity theft, generally:

• Contact the fraud department of any one of the three major credit bureaus (listed below) and place a fraud alert on your credit file. A fraud alert requests that creditors contact you before opening new accounts or making any changes to your existing accounts. The alert will last for 90 days.
• Close the accounts that you know or believe have been tampered with or opened fraudulently.
• File a police report. Get a copy of the report to submit to your creditors and others that may require proof of the crime.
• File a complaint with the Federal Trade Commission at (877) 382-4357.
• Keep records of all phone calls, reports filed, correspondence, etc., and follow up phone conversations with certified letters to confirm your communication.
• Check your bank and credit card statements regularly and report any unauthorized charges, no matter how small, to your bank or financial institution.
• Check your credit report once a year to monitor any changes.

How to protect yourself from being a victim of identity theft, generally:

• Check your bank and credit card statements regularly and report any unauthorized charges, no matter how small, to your bank or financial institution.
• Check your credit report once a year to monitor any changes.
• Don’t carry your social security card in your wallet.
• Shred all credit card offers, bank and credit card statements, household bills, and all other mail or paperwork that includes personal identifying information before you toss it in the trash.
• Get a copy of your credit report. Under federal law, you are entitled to one free copy of your credit report every 12 months from each of the three nationwide credit reporting agencies. You may obtain a free copy of your credit report by going to www.annualcreditreport.com or by calling (877) 322-8228.

You may contact the nationwide credit reporting agencies at:

• Equifax, (800) 525-6285, www.equifax.com
• Experian, (888) 397-3742, www.experian.com
• TransUnion, (800) 680-7289, www.transunion.com