In the RIBridges breach, Rhode Island owned the outage and its vendor owned the evidence
When attackers breached the vendor-run RIBridges benefits system, the state carried public accountability while the vendor held the systems, logs and forensic work. Contracts for such systems must settle visibility, decision rights, costs and exit before an incident, not during one.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On December 13, 2024, Rhode Island’s governor announced that RIBridges, the state’s integrated eligibility system for Medicaid, SNAP, cash assistance, child care assistance and coverage through the state health exchange, had been breached. Deloitte, which built and operated the system under contract, had detected suspicious activity earlier in December. It later confirmed that an attacker had likely obtained personal information, including Social Security numbers and some bank account details. The state directed that the system be taken offline, which pushed applicants to paper and in-person processes. The Brain Cipher ransomware group claimed responsibility and later posted data it said it had stolen. The state arranged credit monitoring for affected people and said it expected the vendor to bear the costs of the response. The state later estimated that about 657,000 people were potentially affected.
Many states run benefits eligibility systems through large vendors that design, host and operate them. The model is reasonable. These systems are complex, change constantly with federal and state policy, and require skills states rarely keep in-house. RIBridges showed the gap the model creates during a breach. The public, the legislature and the press held the governor and the agencies accountable. The vendor held the systems, the logs and the forensic evidence, and had legal and commercial interests of its own.
That gap is a procurement problem, and it is closed only in the contract. Four questions together define who controls a breach response: who sees what, who decides what, who pays for what, and whether the state can leave. They do not overlap, and a contract that settles all four leaves no part of the response to negotiation under pressure. Most large state system contracts answer some partially and others not at all.
Visibility: who sees what, and when
A state cannot manage what it cannot see. In vendor-operated systems, security monitoring, logs and alerts often sit entirely with the vendor. The state learns of an incident when the vendor tells it, and learns the details at the vendor’s pace and in the vendor’s format.
Contracts should require notice of suspected incidents within hours, not days, and give the state continuous read access to security logs and monitoring dashboards. They should let the state appoint its own forensic investigator with full access to evidence, and require the vendor to preserve that evidence. Where the vendor’s outside counsel directs the investigation to protect privilege, the state should know in advance which reports it will receive, in what form and by when. A state that receives only a summary may be unable to answer its own legislature.
Visibility must also reach the vendor’s own suppliers. Large integrators rely on hosting providers, subcontracted developers and support firms, any of whom can be the entry point. The contract should require the vendor to list those parties, flow down the same notice and evidence duties, and tell the state before adding new ones with access to the system or its data.
Decision rights: who decides what
During a breach, decisions come fast: whether to take the system offline, what to tell the public, whether to engage with attackers, when to restore service, and how to reopen accounts safely. In Rhode Island the state directed the shutdown. That was the right authority, but many contracts never say so explicitly.
The contract should state that the state decides matters affecting public services and public communications, and that the vendor executes those decisions. It should define a joint incident command, agreed before any incident, with named roles and alternates on both sides. It should reserve to the state any decision about payments or communications with attackers, which raise legal and policy questions only the state can answer. And it should set restoration criteria, such as evidence of eradication and a credential reset plan, that the state approves before reopening.
Costs: who pays for what
Breach costs include forensics, legal advice, notification, credit monitoring, call centers, manual processing while systems are down, and restoration. Whether a state recovers them depends on the contract.
Contracts should specify which costs the vendor bears when a breach arises from its systems or failures. Limits of liability deserve particular scrutiny. Caps tied to a fraction of annual contract value can sit far below the cost of a breach affecting a large share of a state’s residents. A better approach sets a separate, higher cap for data security incidents, sized against realistic per-person response costs for the population served. Cyber insurance requirements, with the state named as an additional insured where appropriate, give the cap something to draw on. States should take counsel’s advice on these terms.
Cost recovery also depends on records the state keeps itself. Overtime for eligibility workers processing paper applications, extended call center hours and temporary staff are real costs, but they are easy to lose in normal budgets. A cost code opened on the first day of an incident, used by every affected agency, makes the claim against the vendor or insurer defensible later.
Exit: whether the state can leave
The fourth question is the one states least want to ask and most need to. If trust in a vendor breaks, can the system move to another operator? In practice, eligibility systems are heavily customized, and the knowledge to run them sits with the vendor’s staff.
Credible exit requires complete, current documentation; ownership or a perpetual license for custom code and configurations; regular data exports in usable formats; and defined transition assistance with rates fixed in advance. A state that never uses these rights still benefits from holding them. They change the balance of every negotiation, including the cost discussion during an incident.
Vendors will price these terms, and that is appropriate. The alternative is paying later, in unrecovered costs and in bargaining power the state does not have when it needs it.
With hindsight
State staff regained access to RIBridges in early January 2025. From late January, customers received password reset emails in waves, deliberately sent without links to reduce phishing risk, and the public portal was largely back by February. In early February the governor’s office announced that Deloitte had paid the state $5 million toward its additional costs, on top of paying for credit monitoring and identity protection for those potentially affected. The state did not publish a full accounting of total response costs, so how much of the bill that covered is not public. Pressure on vendor-run eligibility systems then grew for a different reason: the 2025 federal budget law changed Medicaid and SNAP eligibility rules, requiring substantial system modifications, which a later article in this series discusses. That made contract terms on visibility, decision rights and exit more valuable, since states had to direct major changes through the same vendors.