{"id":258619,"date":"2025-05-26T21:33:32","date_gmt":"2025-05-26T21:33:32","guid":{"rendered":"https:\/\/peraltafinancing.com\/accounting\/investigation-finds-it-was-deloitte-credentials-that-allowed-hackers-into-the-rhode-island-benefits-system\/"},"modified":"2025-05-26T21:33:32","modified_gmt":"2025-05-26T21:33:32","slug":"investigation-finds-it-was-deloitte-credentials-that-allowed-hackers-into-the-rhode-island-benefits-system","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=258619","title":{"rendered":"Investigation Finds It Was Deloitte Credentials That Allowed Hackers Into the Rhode Island Benefits System"},"content":{"rendered":"


\n<\/p>\n

\n

Oops.<\/p>\n

Late last year, the state of Rhode Island discovered nefarious individuals had gained access to their state benefits system RI Bridges, a system built and managed by Deloitte. This meant hackers got their hands on the personal information of Rhode Islanders who\u2019d used state programs such as Medicaid, SNAP, Medicaid, health coverage purchased through HealthSource RI, and at-home care services provided by the state, among other things.<\/p>\n

In February we reported on Deloitte making a $5 million payment to the state<\/a> at the behest of the governor to help with expenses related to the breach. Revisiting what we wrote at that time:<\/p>\n

\n
\n

It appears the group that got Deloitte UK<\/a> [in 2024] is the same one that penetrated the Deloitte-managed RI Bridges system: Brain Cypher. Adding insult to injury,\u00a0Brain Cypher sent Deloitte a screenshot of some of the data they got<\/a>.<\/p>\n

As the news of the breach was hitting the news in mid-December, Deloitte released this statement: \u201cOur investigation indicates that the allegations relate to a single client\u2019s system which sits outside of the Deloitte network. No Deloitte systems have been impacted.\u201d Whew, as long as your systems are safe. Who cares about a bunch of kids on food stamps amirite.<\/p>\n

At\u00a0a press conference shortly after news of the breach hit<\/a>, Rhode Island\u2019s chief digital officer wasn\u2019t so quick to let the firm pass the buck:<\/p>\n

\n

Asked during a Smith Hill news conference how the hack happened, and whether Deloitte was responsible, [CDO Brian] Tardiff said, \u201cIt\u2019s an ongoing investigation, so we can\u2019t provide any details at this point. We do expect a full root cause analysis that will provide those details.\u201d<\/p>\n

Tardiff added that RI Bridges \u201cis maintained and operated by Deloitte, so we believe it [the breach] is not from the state.\u201d<\/p>\n<\/blockquote>\n<\/div>\n<\/div>\n

In order to get to the bottom of things, cybersecurity firm CrowdStrike was brought in to do an independent investigation and the results are in. The timeline, as outlined by a press release on May 15<\/a>, is as follows:<\/p>\n