An unknown threat actor has stolen data belonging to potentially hundreds of thousands of residents of Rhode Island in a cyberattack and is threatening to release the data if a payment is not made.

The cyberattack was first detected on Dec. 5 when Rhode Island state officials were informed by its technology vendor, Deloitte Touche Tohmatsu Ltd., that the RIBridges data system had been the target of a potential cyberattack. RIBridges is Rhode Island’s integrated online system for managing public assistance programs.

Forward to Dec. 10 and Deloitte then advised the state that the RIBridges system had been breached and that those behind the breach had sent a screenshot of file folders stolen to Deloitte. The following day, Deloitte confirmed that there was a high probability that the folders contained personally identifiable data from RIBridges.

On Dec. 13, Deloitte confirmed that it had found malicious code in the system. The state then directed Deloitte to shut RIBridges down to remediate the threat.

According to a press release from the governor of Rhode Island, the data stolen may include any individual who has received or applied for health coverage or health and human services programs or benefits. The programs and benefits managed through the RIBridges system include Medicaid, the Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Families, the Child Care Assistance Program, health coverage purchased through HealthSource Rhode Island, Rhode Island Works, Long-Term Services and Supports and the General Public Assistance Program.

Data stolen may include names, addresses, dates of birth, and Social Security numbers, as well as certain banking information. Rhode Island is providing those affected with free credit monitoring and a dedicated call center for assistance.

Data theft isn’t new, but some parts are missing from this story. Ransomware has not been mentioned, nor have any files reported being encrypted. However, ransomware operators in 2024 have been known to skip encryption and simply steal data to extort victims with a promise that the data will be released unless payment is made. Whether such an attack would still count as ransomware versus simply extortion likely doesn’t matter to the victims.

Whatever the finer details, hundreds of thousands of Rhode Island residents have had their personal data stolen weeks before the New Year, a new year that promises even more such attacks as ransomware operators and similar threat groups continue to cast a wide net for victims.

Image: SiliconANGLE/Ideogram