Rhode Island Secures $12 Million Settlement from Deloitte Over 2024 RIBridges Data Breach The Rhode Island Department of Administration has finalized a $7 million settlement with Deloitte Consulting LLP, bringing the state’s total recovery from the 2024 RIBridges data breach to $12 million. The agreement, signed by Deloitte Principal Lindsay Musser Hough on April 15 and Acting Department Director Thomas Verdi on April 16, requires payment within 30 days unless an extended deadline is granted. Deloitte, the vendor behind RIBridges a state platform handling Medicaid, food stamps, and health insurance applications had already provided $6 million in additional system enhancements and support at no cost to Rhode Island. The breach, discovered in December 2024, stemmed from a cyberattack by the group Brain Cipher, which infiltrated the system’s backend in July 2024 using stolen credentials from a Deloitte representative. The threat actors remained undetected for months, exfiltrating data from 28 of RIBridges’ 338 backend environments before triggering alerts in late November. Governor Dan McKee first publicly disclosed the breach on December 13, 2024, after Deloitte confirmed the incident following a dark web post by Brain Cipher. The attack compromised the personal information of an estimated 644,401 individuals, including applicants and beneficiaries of state benefits. A third-party forensic report by CrowdStrike later revealed that the last malicious activity occurred on Thanksgiving Day 2024, though Deloitte did not notify the state until December 5. In February 2025, the state received an initial $5 million from Deloitte to cover breach-related expenses. The latest settlement resolves all legal disputes between the parties, with both agreeing to refrain from further litigation, public disparagement, or encouraging third-party lawsuits. The agreement also includes a non-disparagement clause, requiring coordinated public statements. Separately, Deloitte settled a class-action lawsuit in October 2025, which included Rhode Island as a "released party," shielding the state from additional claims. Over 47,000 class members filed claims for compensation, with most receiving around $100 and others eligible for higher reimbursements with documented losses. While the forensic report attributed the breach to Deloitte’s failure to detect the intrusion, the settlement explicitly states that neither party admits liability. The state’s legal recourse appears exhausted, though Governor McKee previously stated that Deloitte bore responsibility for oversight lapses.