Governor McKee Issues Update on Cybersecurity Breach of RIBridges System

From: Rhode Island Governor Daniel McKee
December 14, 2024

PROVIDENCE, RI - Governor Dan McKee, joined by members of his Administration, hosted a media availability Friday regarding a cybersecurity breach of the RIBridges system.

Background

On December 13, 2024, the State was informed by its vendor, Deloitte, that there was a major security threat to the RIBridges system. In response, we have proactively taken the system offline so that the State and Deloitte can work to address the threat and restore the system as quickly as possible. Additionally, Deloitte confirmed that there is a high probability that a cybercriminal has obtained files with personally identifiable information from RIBridges. 

Information for Customers 

We understand this is an alarming situation for our customers. Current customers will not be able to log into their account through the portal or the mobile app while the system is offline. Updates will be made available at https://admin.ri.gov/ribridges-alert

Rhode Islanders seeking to apply for benefits can still submit a paper application.

Details about the Threat  

On December 5, the State was informed by its vendor, Deloitte, that the RIBridges data system was the target of a potential cyberattack. At that time, it was unclear if any sensitive information was breached. At that time, appropriate federal law enforcement and agencies were notified, as well as the Rhode Island State Police. 

After consultation with our state IT department, Deloitte immediately implemented additional security measures and started to assess the threat. It was important, for security reasons, to keep this knowledge internal until we could secure the RIBridges system. At the same time, our team began an investigation into what data may have been compromised, and how a possible attack was able to occur.  

On December 10, the State received confirmation from Deloitte that there had been a breach of the RIBridges system based on a screenshot of file folders sent by the hacker to Deloitte. On December 11, Deloitte confirmed that there is a high probability that the implicated folders contain personal identifiable data from RIBridges. On December 13, Deloitte confirmed there was malicious code present in the system, and the State directed Deloitte to shut RIBridges down to remediate the threat. State police and federal law enforcement are involved in an advisory capacity and no further leads have been provided.

Details about the Data Breach   

To the best of our knowledge, any individual who has received or applied for health coverage and/or health and human services programs or benefits could be impacted by this leak. The programs and benefits managed through the RIBridges system include but are not limited to:  

- Medicaid
- Supplemental Nutrition Assistance Program (SNAP)  
- Temporary Assistance for Needy Families (TANF)
- Child Care Assistance Program (CCAP)
- Health coverage purchased through HealthSource RI   
- Rhode Island Works (RIW)
- Long-Term Services and Supports (LTSS)
- General Public Assistance (GPA) Program  

While the analysis of the breach is still underway, unfortunately, Deloitte has indicated that the information involved may include names, addresses, dates of birth and Social Security numbers, as well as certain banking information, but is still assessing the situation.     

Households that may have had personal information compromised will receive a letter by mail from the State that explains how to access free credit monitoring. A dedicated call center for impacted customers will be available Sunday, December 15 from 11 a.m. to 8 p.m. After Sunday, the call center will be open Mondays through Fridays from 9 a.m. to 9 p.m. EDT. The State will update its website with the call center number on Sunday morning. 

We are currently unaware of any identity theft or fraud related to this data breach. However, we advise customers to remain vigilant and monitor their accounts for any unauthorized activity. This includes: 

- Taking steps to freeze credit and/or place a fraud alert through the three major credit bureaus (Visit https://www.usa.gov/credit-freeze for more information and see contact information for the three credit bureaus below). 

- As a best practice, customers should change any common or reused passwords to a new strong and unique one. Using a safe and secure password manager is the most effective way to reduce risks of password misuse. 

- Customers can also call their bank to ask what steps may be taken related to the security of their bank account.  

We will continue to provide updates as we receive them. Please visit our website for the latest information: https://admin.ri.gov/ribridges-alert.

Latest News

Governor McKee Shares Information for Protecting Children’s Credit

From: Rhode Island Governor Daniel McKee
December 20, 2024
PROVIDENCE, RI - Governor Dan McKee has outlined resources available to help parents and families who may be concerned about the security of their children’s credit in light of the recent… Read More

New Initial RFP Released for Washington Bridge Rebuild Project

From: Rhode Island Governor Daniel McKee
December 18, 2024
PROVIDENCE, RI - Governor Dan McKee today announced that the new initial Request for Proposals (RFP) for the Washington Bridge Replacement Project is now live. The initial RFP includes changes to… Read More

Governor McKee Extends Hours for RIBridges Data Breach Call Center

From: Rhode Island Governor Daniel McKee
December 17, 2024
Hours for select DHS offices are also extended PROVIDENCE, RI - On December 17, 2024, at Governor Dan McKee’s direction, the RIBridges Data Breach Hotline has been extended to operate on… Read More

Governor McKee Releases Public Service Announcement on How Impacted Rhode Islanders can Protect Personal Information

From: Rhode Island Governor Daniel McKee
December 16, 2024
PROVIDENCE, RI - On December 16, 2024, Governor Dan McKee issued a message to the public urging Rhode Islanders who may have been impacted by the data security threat to RIBridges to take five key… Read More

RIBridges Data Breach Call Center Opens Today

From: Rhode Island Governor Daniel McKee
December 15, 2024
PROVIDENCE, RI - In response to the RIBridges data breach, Deloitte has contracted with Experian to run a multilingual call center. A toll-free hotline will open today, Sunday, December 15, from 11… Read More