Hackers Steal Data From Rhode Island Citizens

Governor Daniel McKee said the personal information of hundreds of thousands of Rhode Island citizens may be at risk after a cyberattack breached the state’s online portal for social services. The hacking group “Brain Cipher” has since claimed responsibility for the attack and demanded a ransom for the information.

State officials disclosed the breach on December 13, after RIBridges vendor “Deloitte” informed the state of a significant security breach and took the system offline. RIBridges is the state’s online portal for applying for social services such as the Supplemental Nutrition Assistance Program (SNAP), Temporary Assistance for Needy Families (TNAF), Child Care Assistance Program (CCAP), and Medicaid.

The state said anyone who has applied for or received benefits through those programs since 2016 could be affected.

According to the governor’s office, Deloitte first informed the state of a potential breach on December 5. Shortly after, on December 10, a hacker sent Deloitte a screenshot of protected file folders, confirming the attack.

The stolen information may include full names, addresses, dates of birth, social security numbers, and banking details. In response, the Rhode Island Department of Administration published a release outlining steps for citizens to protect their data, such as freezing their credit, requesting fraud alerts, and using multifactor authentication. The state will mail letters to any household with compromised personal information explaining how to access free credit monitoring.

The ransomware group Brain Cipher has demanded an undisclosed ransom for not publishing the information. Brain Cipher has also been tied to major international attacks, including a similar attack on more than 200 Indonesian government agencies that involved an 8 million dollar ransom demand.

Affected Rhode Island citizens have filed several class-action lawsuits against Deloitte, claiming negligence, breach of implied contract, and unjust enrichment. “Deloitte’s data security failure resulting from the cyberattack has violated individuals’ rights to have their sensitive personally identifiable information kept confidential,” said Peter N. Wasylyk, a Rhode Island lawyer involved in the suit.

The incident comes at the tail end of a year with dramatic cybersecurity threats worldwide, including the biggest password leak in history.