PROVIDENCE — The vendor that manages Rhode Island’s sprawling state benefits system, which was hacked last year, has agreed to settle multiple class-action lawsuits filed on behalf of thousands of people whose personal information was stolen.
The details of the settlement with Deloitte, which still needs to be approved by a judge, have not yet been released. Once the settlement is finalized, people impacted by the breach are expected to be able to sign up to receive compensation. It is not yet clear if the compensation will be direct payments, credit monitoring, or a combination of both.
The parties reached an agreement following mediation in late August, according to court records, and a judge issued a stay of the lawsuits on Sept. 5 pending final approval of the settlement.
More than 650,000 people had their private data, including Social Security numbers, stolen by a ransomware group called Brain Cipher, which accessed the system by typing in a Deloitte employee’s credentials, an outside investigation found earlier this year.
The investigation found the intrusion into the system started on July 2 of last year, more than five months before it was discovered in December.
The hack affected a wide range of programs under the umbrella of RIBridges, a system used for state benefits such as food stamps, Medicaid, child care assistance, and private health insurance purchased through the state’s marketplace, HealthSource RI.
Names, addresses, dates of birth, phone numbers, bank account information, Social Security numbers, and health information were stolen from the system.
Some people who had never even applied for state benefits were also affected, because their data “passed through” RIBridges during employment checks.
State officials confirmed some of the private information ended up on the dark web.
Six class-action lawsuits were filed in federal court in Rhode Island by people affected by the data breach, which have now all been consolidated. A separate case filed in New York, where Deloitte is based, was dismissed.
The case is separate from any legal action that the state of Rhode Island may take against Deloitte for the cyberattack. Attorney General Peter Neronha previously said he was considering litigation. Neronha’s spokesperson said this week the investigation is still ongoing.
Governor Dan McKee previously said he would “pursue all avenues to ensure accountability” for Deloitte.
The class-action case blames Deloitte for handling the plaintiffs’ private data in a “reckless manner” by storing it on a “computer network in a condition vulnerable to cyberattacks.”
One of the named plaintiffs, Paola Baldomar, claimed in the lawsuit that shortly after the breach, fraudulent credit inquiries in her name were made at AT&T and separately for a car loan. In March, an “unauthorized person” claimed her 2-year-old daughter as a dependent on their tax return, the suit claims. (The daughter’s father is deceased.)
As a result, “Baldomar was forced to spend a significant amount of time filing a police report and talking with the IRS and Social Security administration to correct this fraudulent activity,” the suit claims.
Another plaintiff, Monica DePina, said she had unauthorized charges on her credit card in January, soon after the stolen data was posted to the dark web. Meghan Konopka, another plaintiff, said her debit card was used fraudulently, also in January. Another plaintiff, Joan Ratcliffe, said her bank alerted her that someone was trying to transfer funds out of her account.
Multiple plaintiffs reported receiving dozens of spam calls almost every day after the cyberattack, and spending time changing bank account numbers, freezing credit, and other mitigation efforts.
The lawsuit also criticizes Deloitte for not sending notices to people affected until Jan. 10, despite learning about the intrusion on Dec. 5, losing valuable time they could have used to protect their identities and assets.
Peter Wasylyk, an attorney for the plaintiffs, said his office was contacted by more than 1,000 people affected by the cyberattack after filing the initial lawsuit.
Similar to the named plaintiffs, people reported having money stolen from their bank accounts, unauthorized charges on their credit cards, and tax returns falsely filed in their names, Wasylyk said.
Because data breaches have become so common, it is difficult to say for certain whether identity thieves got the victims’ information from the RIBridges attack, or another breach.
“That is the entire legal issue that we deal with in all of these cases,” Wasylyk said. “That’s why most of them settle, because it’s difficult to prove the nexus between the wrong that occurred to the potential plaintiff or class member, and the actual data breach.”
He said the plaintiffs and wider class members deserve to be compensated.
“They’ve been wronged to a great degree, and we believe that settlements are fair in these types of cases because they reimburse people for the time and effort of dealing with the data breach, and for any actual losses,” Wasylyk said.
Deloitte did not comment on the settlement Wednesday.
The company previously agreed to pay the state of Rhode Island $5 million for expenses related to the cyberattack and offered credit monitoring to people affected.
A spokesperson for the Department of Administration did not immediately say whether there are further expenses the state will ask Deloitte to reimburse, or whether the department is actively pursuing hiring a new vendor to manage the benefits system.
Deloitte’s $207 million five-year contract expires on June 30 of next year.
Steph Machado can be reached at steph.machado@globe.com. Follow her @StephMachado.