Hackers Leak Rhode Island Citizens’ Data on Dark Web

Cybercriminals have begun publishing stolen personal data of Rhode Island citizens, the US state has confirmed.

In an update on December 30, Rhode Island governor Dan McKee revealed the state had been informed by its vendor, Deloitte, that some files containing citizens’ data have been released on the dark web.

McKee said the state had been prepared for this scenario since being informed that cybercriminals had likely obtained files with personally identifiable information (PII) from Rhode Island’s social services portal, the RIBridges system, in December 2024.

McKee commented: “Right now, IT teams are working diligently to analyze the released files. This is a complex process and we do not yet know the scope of the data that is included in those files, but as we’ve been saying for several weeks, we should assume that data contained in the RIBridges system has been compromised.”

Rhode Island’s Department of Human Services (DHS) had already warned that any individual who has received or applied for health coverage and/or health and human services programs or benefits could be impacted by the breach.

The state is now working with Deloitte to identify and inform impacted individuals.

Rhode Islanders have been urged to act to protect their financial information in the meantime, including freezing and monitoring their credit and requesting a fraud check.

Citizens have also been warned that they may be subject to social engineering attacks as a result of the breach.

The RIBridges web portal remains offline while the investigation into the incident continues.

Ransomware Group at Center of Attack

Ransomware group Brain Cipher has been at the centre of this incident after it claimed it had breached Deloitte in early December and stole 1TB of compressed data held by the consultancy giant.

The group gave Deloitte 10 days, until December 15, to respond to the threat.

Deloitte told Infosecurity that the allegations relate to a single client’s system which sits outside of the Deloitte network.

Neither Deloitte nor the State of Rhode Island has confirmed Brain Cipher’s claims.

Brain Cipher first emerged earlier in 2024. Researchers have observed the group engaging in multi-pronged extortion, hosting a TOR-based data leak site. The threat actor’s payloads are based on LockBit 3.0.