Deloitte said its corporate systems were not affected when the Brain Cipher ransomware group claimed it had stolen Deloitte data. Later findings clarified the distinction: attackers accessed a Rhode Island benefits system operated by Deloitte, exfiltrated files containing residents’ information and published at least some of them. Rhode Island’s investigation attributed the initial access to unauthorized use of Deloitte credentials.
What Brain Cipher claimed
On December 4, 2024, Brain Cipher posted on a dark-web leak site that it had stolen more than 1 TB of compressed data from Deloitte UK and threatened to publish it unless a ransom was paid. The 1 TB figure was the group’s allegation, not a measurement independently confirmed in the available official findings. Early reports gave December 15 as the threatened deadline, although contemporaneous coverage noted uncertainty about when it would fall. SecurityWeek reported the claim; Rhode Island Current covered the deadline uncertainty.
A leak-site post is an allegation by a criminal group, not by itself proof of what was accessed, how much was taken or who owned the affected system. Those details became clearer through Rhode Island’s later disclosures.
What Deloitte denied—and what it did not
Deloitte’s reported response was that its investigation indicated the allegations concerned “a single client’s system which sits outside of the Deloitte network” and that “no Deloitte systems have been impacted.” That was a statement about the scope of the company’s own network, not a blanket claim that no client data or Deloitte-operated environment was affected. SecurityWeek and SC Media reported the response.
#1 Best Overall
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
Several layers matter when interpreting that wording:
- Deloitte’s corporate network: Deloitte said its systems were not impacted.
- The client environment: The affected system belonged to a client environment outside Deloitte’s corporate network.
- Operations and access: Deloitte operated and maintained Rhode Island’s RIBridges system. Rhode Island’s later investigation said the attacker used Deloitte credentials.
- Data and people: Files in that client system included information relating to Rhode Island residents and public-benefit programs.
So “Deloitte’s corporate network was not reported compromised” and “a Deloitte-operated client system was breached” describe different parts of the incident; they are not necessarily contradictory.
How the breach was connected to Rhode Island’s RIBridges system
RIBridges supports Rhode Island health coverage and human-services programs, including Medicaid, SNAP, TANF, Rhode Island Works, child-care assistance, long-term services and supports, general public assistance, and HealthSource RI coverage. Deloitte operated and maintained the system. The incident therefore concerned both a vendor-managed technology environment and a state service used to administer benefits—not just Deloitte’s internal network. Rhode Island’s initial update described the system and programs.
The state’s December 14, 2024 update laid out what it had learned from Deloitte:
Recommended Free Tools
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- December 5: Rhode Island was informed that RIBridges was the target of a potential cyberattack.
- December 10: Deloitte confirmed a breach after receiving a screenshot of file folders from the attacker.
- December 11: Deloitte assessed that the implicated folders probably contained personally identifiable information.
- December 13: Malicious code was confirmed, and the state directed Deloitte to take RIBridges offline.
Rhode Island later connected the Brain Cipher leak-site post to suspicious activity in the RIBridges environment. The released investigation summary describes that connection.
What information was involved
Rhode Island said information that could be in affected files included names, addresses, dates of birth, Social Security numbers and certain banking information. The initial warning described potentially involved information; it did not establish that every listed data type appeared in every affected person’s records. The state’s incident update lists the categories.
It helps to distinguish four stages: information a system may store, files an intruder accessed, files the intruder exfiltrated, and information later confirmed in released files. These are not interchangeable. Rhode Island initially said the scope was still being assessed; on December 30, it reported that at least some RIBridges files had been released on the dark web. The state did not establish that the complete data set—or the group’s claimed 1 TB—was published. The December 30 update confirmed the release.
What Rhode Island’s later investigation found
In findings released May 15, 2025, Rhode Island said a third-party CrowdStrike investigation determined that an attacker gained access in July 2024 through unauthorized use of Deloitte credentials. The investigation found access to 28 systems in the RIBridges environment between July and November, with files exfiltrated from November 11 through November 28. Rhode Island said the attacker was no longer present after November 28. The investigation identified 644,401 individuals as impacted. The state’s summary of the findings provides those figures.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
“Impacted” does not mean that every person experienced identity theft. Rhode Island said data compromise alone did not establish that identity theft had occurred. The official findings establish access and exfiltration; they do not show that every exposed record was misused.
A separate figure appears in the settlement FAQ: Rhode Island sent notices to 735,501 individuals whose private information may have been impacted. That notice total differs from the 644,401 people identified by the investigation, and the figures should not be treated as identical counts. They may reflect different populations or definitions. The settlement FAQ gives the notice figure.
Was this a ransomware attack?
Brain Cipher was a ransomware group, and its threat to publish data fits a data-extortion tactic: steal files and use the threat of exposure to pressure the victim. But the evidence summarized by Rhode Island supports describing this as a ransomware-group claim and a data-exfiltration or extortion incident—not as proof that Deloitte’s corporate systems were encrypted. No such encryption is established in the cited public findings.
Data theft can be the central pressure tactic even when encryption is absent or not publicly documented. Deloitte’s discussion of evolving ransomware tactics includes data theft, reputational threats and regulatory pressure. Its 2025 mid-year cyber threat trends report describes that broader pattern.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
What happened after the threatened publication date
Although early reporting gave December 15, 2024, as the deadline, Rhode Island said on December 30 that at least some RIBridges files had appeared on a dark-web site. That confirms publication of some files, not the entire volume Brain Cipher claimed to hold.
On January 10, 2025, the state announced that official letters were being mailed to affected individuals. Rhode Island’s notice announcement is the appropriate starting point for people seeking official information.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Financial accountability and public-service impact
RIBridges supports benefits and health coverage, so taking it offline for remediation affected infrastructure used to deliver public services. The incident was not only a data-security event: it involved a system supporting access to Medicaid, food and cash assistance, child-care benefits and health insurance. Rhode Island’s initial incident update describes the programs connected to the system.
On April 24, 2026, Rhode Island announced a further $7 million settlement payment from Deloitte, in addition to an earlier $5 million payment, bringing the state’s direct financial recovery to $12 million. The state also said Deloitte provided $6 million worth of system enhancements, operational support and business-continuity services outside the original contract. These are distinct forms of recovery: the $12 million was direct payment to the state, while the $6 million was additional services. Rhode Island’s settlement announcement details the agreement.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsBest Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What potentially affected Rhode Island residents can do
Residents should use official state notices and settlement resources rather than dark-web material or unofficial breach-lookup services. Rhode Island advised people to take practical steps to reduce exposure to fraud:
- Monitor bank, credit-card and benefits accounts for unfamiliar activity.
- Consider placing a credit freeze or fraud alert with the credit bureaus.
- Change passwords that were reused, especially on financial or email accounts.
- Ask financial institutions what account-protection measures are available if banking information may have been involved.
- Be alert to phishing and identity-theft attempts, including messages that exploit news of the breach or appear to come from a government agency.
For the state’s original guidance and incident details, consult Rhode Island’s RIBridges incident notice. For information about notices and the settlement, use the state’s notice announcement and the official settlement FAQ.
Why the wording matters for vendor risk
The incident illustrates a limit of statements focused only on a company’s internal network. A vendor’s corporate environment can be distinct from a client’s dedicated system, while the vendor may still operate that system and hold credentials that provide access. For organizations assessing third-party risk, the relevant questions extend beyond whether the provider’s own network was breached:
- Which client systems does the provider operate or maintain?
- What credentials can reach those environments, and how are they protected and monitored?
- Can access be limited to the systems and tasks needed?
- How quickly can a client isolate a service, investigate suspicious activity and notify people whose data may be involved?
Those questions are especially consequential when a vendor-managed system supports public benefits or other essential services. In this case, Rhode Island’s later findings connected unauthorized use of Deloitte credentials with access to the RIBridges environment, even as Deloitte’s original statement addressed its own network.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
