$6.3M RIBridges Settlement Ends Class Action Suit Over Dec. 2024 Rhode Island Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Deloitte Consulting LLP has agreed to a $6,300,000 class action settlement to resolve a lawsuit that alleged that RIBridges—Rhode Island’s state system for providing benefits, health insurance, and other programs to residents—was the target of a December 2024 cyberattack while under Deloitte management.

Want to stay in the loop on class action lawsuits that matter to you? Sign up for ClassAction.org’s free weekly newsletter.

The Deloitte RIBridges class action settlement received preliminary approval from the court on October 23, 2025 and covers all United States residents who received notice that their private information may have been compromised as a result of the RIBridges data breach. Per court documents, Rhode Island sent data breach notice letters to approximately 735,501 people.

The court-approved website for the Deloitte class action settlement can be found at https://RIBridgesDataSettlement.com/.

According to the site, RIBridges settlement class members who submit a timely, valid claim form have multiple options for reimbursement. Those who submit with their claim form documented proof of out-of-pocket losses are eligible to receive a one-time cash payment of up to $5,000, which is referred to as “Cash Payment A.” The settlement agreement explains that covered losses must have been incurred as a result of the data breach, and reimbursable expenses include costs related to credit monitoring, identity theft and fraud.

In lieu of a documented-loss payment, the settlement website says class members may instead file a claim form to receive a one-time, pro-rated alternate cash payout estimated to be $100, which is referred to as “Cash Payment B” in all court documents.

The settlement agreement relays that class members may elect to receive their payout via check or electronic payment, and that all checks must be cashed within 90 days of issuance before expiration.

In addition to monetary reimbursement, all class members with valid claim forms are also eligible to enroll in two free years of one-bureau medical data monitoring from CyEx, which provides services like credit file monitoring, dark web scanning, security freezing assistance, identity theft insurance and access to fraud resolution agents.

To submit an RIBridges claim form online, class members can head to this page and enter the class member ID found on their copy of the settlement notice. Consumers who believe they may be a class member but did not receive a copy of the class action settlement notice should contact the settlement administrator to confirm their identity and receive their login ID.

Alternatively, class members can download a PDF of the claim form to print, fill out, and return by mail to the address listed on the first page of the document.

All Deloitte settlement claim forms must be submitted online or by mail by January 14, 2026.

The court will determine whether to grant final approval to the Deloitte settlement at a hearing on January 29, 2026. Compensation will begin to be distributed to class members only after final approval is granted and any appeals are resolved.

The class action lawsuit alleged that Deloitte failed to properly safeguard the consumer information the consulting firm stored as part of its management of RIBridges, which Rhode Island has sanctioned the company to operate since 2016, leading to a late 2024 data breach. Per court documents, the consumer data that was potentially compromised includes, but is not limited to, names, addresses, dates of birth, Social Security numbers, banking information, contact information and medical histories.

Check out ClassAction.org’s free legal resources to learn how to start a class action lawsuit.