Deloitte has agreed to pay US$5 million to the state to offset costs incurred due to a ransomware attack that disrupted the state’s RI Bridges system in December 2024, Rhode Island Governor Dan McKee said. The system, which manages eligibility for critical public benefits such as Medicaid, SNAP, HealthSource RI, and RI Works, suffered a prolonged outage following the attack, affecting thousands of residents.
The cyberattack was detected on December 5, 2024, and exposed sensitive personal information belonging to more than 650,000 Rhode Islanders. The stolen data, which included names, contact information, employment details, and Social Security numbers, was subsequently published on the ransomware group’s data leak site after the state refused to pay the ransom.
The outage persisted for approximately two months, preventing around 2,000 Rhode Islanders from enrolling in state-funded healthcare coverage through Blue Cross & Blue Shield and Neighborhood Health. The disruption caused significant challenges for affected residents who rely on these programs for essential healthcare services.
Principal at Deloitte Consulting, Lindsay Musser Hough emphasized that the company’s agreement to provide US$5 million to Rhode Island is not an admission of wrongdoing or liability. Instead, she characterized the payment as a demonstration of Deloitte’s commitment to supporting the state and its constituents in responding to the cyberattack.
Governor McKee appreciated Deloitte’s financial contribution, acknowledging the company’s recognition of the state’s immediate and unexpected expenses from the breach. “Deloitte has recognized that the state has immediate and unexpected expenses related to the breach, and we appreciate their willingness to lend financial support,” he stated.
In addition to the US$5 million payment, Deloitte has covered the costs of credit monitoring and identity theft protection services for over 650,000 individuals whose data was compromised. The company is also funding the operations of the data breach call center, which has been set up to assist affected individuals with concerns related to the attack.
