Deloitte reaches $6.3M deal to settle class action lawsuit in RIBridges data breach

State contractor Deloitte has agreed to pay a proposed $6.3 million under a settlement to resolve claims related to last year’s RIBridges data breach filed Thursday in U.S. District Court for the District of Rhode Island.

The proposed agreement, filed Thursday in U.S. District Court for the District of Rhode Island, still needs final approval from a federal judge, but members of the class — a total of 735,501 people, according to court filings — could receive an estimated $100 with no documentation of identity theft needed.

But those checks could quickly shrink as the settlement fund needs to pay for attorneys’ costs and other legal fees. The more claims there are, the smaller the payouts will be.

A Deloitte spokesperson declined to comment when reached by email Friday. 

Settlement in the works to resolve RIBridges class action lawsuit

The settlement agreement notes that “Deloitte denies all liability and wrongdoing,” and the agreement shields the company from future litigation by people who do not send a request to opt out, whether or not they submit a claim. 

Tim Rondeau, a spokesperson for Rhode Island Attorney General Peter Neronha, said via email Friday that “The State is not a named party to this action and did not participate in this settlement.” But the deal does shield the state — by declaring it a “released party” — and its agencies from any related lawsuits by class members who don’t opt out of the settlement.

“The State had a contract with Deloitte for IT and computer processing of the state programs such as food stamps,” Peter Wasylyk, part of the plaintiffs’ legal team, said.

The case was originally filed last December, after the breach was first made public, by Wasylyk on behalf of food stamps and other public benefit recipients whose personal data was impacted. RIBridges is the unified platform made and still currently run by Deloitte which helps residents access public benefits and the state’s health insurance marketplace. The data plundered by cybercrime outfit Brain Cipher in the breach included information used to apply for these services. 

The case was eventually consolidated with several other named plaintiffs into the current class action suit.

While the state is not named as a defendant in the suit, its inclusion as a party released from future litigation is not unusual in a large class action lawsuit. In law, the concept of “global peace” often extends future legal protections to entities beyond the ones being specifically sued.

Meanwhile, both parties are still waiting for updates, and Wasylyk said the court is still reviewing the settlement agreement. The agreement will need a preliminary approval and a final approval. Claims will be due before the judge issues final approval. 

An approximate timeline in the agreement would see the final approval hearing take place “at least 100 days after the motion for preliminary approval” is filed, meaning sometime in Jan. 2026, but that schedule could change with the availability of U.S. District Judge Melissa R. Dubose, who is assigned to the case.

Claims will eventually be open for submission on a website and toll-free line run by Kroll, a firm noted for its settlement administration services. After a judge’s preliminary approval, Kroll will also send out postcard notices to eligible class members, with information on how to submit claims by mail. Those postcards will go out within 30 days of the judge’s preliminary approval. 

Anyone who received an RIBridges breach notice earlier this year is likely eligible to stake a claim. Class members can opt out of the settlement benefits if they so choose. Otherwise, they remain eligible for one of the following:

• Reimbursement up to $5,000 with third-party documentation like phone records, receipts, emails, and so on, that show evidence of harm or identity theft from the breach. 
• An estimated $100 reimbursement, no documentation needed.

Kroll will also handle opt-out requests, which requires class members to “send a request…or written notice” asking to be excluded from settlement. The deadline to opt out or submit objections is 30 days before the final approval hearing. Class members who do not submit or opt out will not receive any compensation, and they will also lose their ability for future litigation.

The settlement also provides all class members, regardless of which reimbursement they choose, the option to sign up for two years of medical data monitoring from CyEx.

Wasylyk said Friday that the $100 is the baseline both parties agreed to, and that class members could see more money if there aren’t enough claimants to “exhaust” the full $6.3 million.

“In that case a pro-rata increase to more than $100 would go to class members,” Wasylyk explained. 

But the settlement agreement details that these payouts are subject to “pro rata increase or decrease,” meaning they go up or down depending on the final number of claims. The total $6.3 million windfall also includes attorneys’ fees and other litigation costs, as well as the expense of the CyEx medical monitoring.

A draft of the claim submission form clearly delineates the money that could be deducted from the total: “up to one-third of the $6,300,000 Settlement Fund ($2,100,000), plus reimbursement of costs” for the class’ legal team, plus “Service Awards in the amount of $2,500 to each Class Representative,” which are the named plaintiffs in the class suit.

After people choose how to be paid, any residual funds would go toward the Electronic Privacy Information Center, a digital-privacy nonprofit based in Washington, D.C, after 240 days.