Rhode Island began mailing notification letters Friday to alert individuals impacted by the December ransomware attack against the state social services agency, Gov. Dan McKee said during a Friday press conference.
Officials estimate the information of 657,000 people was accessed in the attack, but the state sent letters to 709,000 individuals, as some people in the database are cared for by relatives or other people. Victims will get five years of free credit monitoring and additional identity protection services.
A threat group called Brain Cipher claimed credit for the attack against the RIBridges database, which includes a range of social services for hundreds of thousands of people in the state. The benefits range from food assistance to health coverage and cash benefits, among other programs.
Hackers began releasing information on a leak site in late December, and officials have been analyzing the data to confirm what type of information was leaked. The hacked data potentially includes names, addresses, Social Security numbers, dates of birth, phone numbers, health information and banking information, the letter said.
The notification letters are expected to take a few days to get out to affected people. Deloitte is still reviewing information that was impacted by the hack and provided a summary report, however McKee warned it is likely more victims of the hack will be identified. If additional people are identified, they will also get copies of the letter.
Deloitte is responsible for covering the costs stemming from the investigation and remediation of the site.
Officials said they are confident the security threat has been remediated, based on the third-party forensics report.
“The findings in these reports provide a high level of confidence that we know how the breach was executed, and that we have taken the appropriate measures to ensure the system can be restored safely,” Brian Tardiff, chief digital officer for Rhode Island, said at the press conference.
A two-phase restoration plan is underway, and they are working on phase two, which is the public facing section of the database, Tardiff said. They are targeting a mid-January resumption of the database.
