Rhode Island computer network hit by cyberattack

The attack resulted in the state shutting down its online benefits systems. 

What happened

Rhode Island recently took its RIBridges system offline following a cyberattack. According to a report, hackers successfully accessed RIBridges, the online portal that allows residents to apply for social services like Medicaid benefits and health insurance. The attack, which Rhode Island’s government was informed of on December 13th, resulted in potentially hundreds of thousands of residents having their data leaked. 

Governor Dan McKee said attackers may have gotten personal info like names, addresses, and social security numbers of individuals who had used the RIBridges system between 2019 and now. 

Going deeper

According to a spokesperson, the attack was not an instance of ransomware, but rather “more of an extortion type activity by this cybercriminal group.” Currently, the group has not been named. 

The attack also impacted HealthSource, RI, Rhode Island’s healthcare marketplace. The incident resulted in the website being taken offline, although the state hopes to get the system back online before the healthcare open enrollment period ends on January 31st. 

In a press release, the Rhode Island government said that the breach was connected to Deloitte, a vendor impacted by an attack on December 5th. Rhode Island said, “Deloitte immediately implemented additional security measures and started to assess the threat.” The organization opted to keep the incident private until it could secure the RIBridges system.

Individuals impacted by the breach will receive a letter from the state explaining how to access free credit monitoring services. Rhode Island has also created a call center to answer questions from impacted customers. 

Why it matters

Data breaches like these can affect massive amounts of people. In this case, hackers were able to access a significant amount of sensitive information, making individuals who may already be experiencing financial hardship more likely to face fraud or identity theft. 

For Rhode Island, the incident could result in penalties from the Department of Health and Human Services, as well as class action lawsuits from individuals who may have been impacted. 

Related: HIPAA Compliant Email: The Definitive Guide