RIBridges Data Breach Settlement: $6.3M

Individuals who received a data breach notice from the state of Rhode Island indicating their personal information may have been compromised in the December 5, 2024, incident.

Documentation of losses, such as account records, IRS letters, phone records, tax forms, receipts, or other correspondence.

Deloitte has agreed to a $6.3 million class action settlement to resolve allegations that it failed to prevent a major data breach affecting the state-run RIBridges system in Rhode Island.

On December 5, 2024, a cybersecurity incident reportedly exposed the personal data of more than 735,000 residents. Information compromised in the breach included Social Security numbers, banking details, and sensitive health information. The state of Rhode Island sent notifications to those affected.

A class action lawsuit followed, accusing Deloitte—the consulting firm responsible for managing the RIBridges system—of failing to implement reasonable security protections that could have prevented the breach. Deloitte has denied any wrongdoing but agreed to settle the case to avoid further litigation.

As part of the settlement, affected individuals can claim up to $5,000 for documented losses directly resulting from the data breach. Those without documented losses may instead opt for a $100 alternate cash payment.

In addition, all class members are eligible to receive two years of free medical data monitoring through CyEx. This service includes identity theft protection, dark web surveillance, fraud resolution support, and $1 million in identity theft insurance.

To receive compensation or monitoring services, class members must submit a valid claim form by January 14, 2026. The deadline to object to or opt out of the settlement is December 30, 2025, and the final approval hearing is scheduled for January 29, 2026.