In the RIBridges breach, Rhode Island owned the outage and its vendor owned the evidence

The week

On December 13, 2024, Rhode Island’s governor announced that attackers had broken into RIBridges. For hundreds of thousands of Rhode Islanders, the system is the front door to help with groceries, health coverage and child care.

RIBridges is what government technologists call an integrated eligibility system: one computer system that takes applications, checks whether people qualify and manages their cases across several programs at once. In Rhode Island that meant Medicaid, SNAP (the federal food assistance program once known as food stamps), cash assistance, child care assistance and coverage through the state health exchange. The exchange is the marketplace where residents buy subsidized health insurance. To do that job, the system has to hold exactly the kind of information criminals want: names, incomes, household details, identification numbers and bank accounts for benefit payments.

The full list of programs was longer. The state’s notice covered eight programs: Medicaid, SNAP, Temporary Assistance for Needy Families, the Child Care Assistance Program, HealthSource RI, Rhode Island Works, Long-Term Services and Supports, and General Public Assistance. For a state of about 1.1 million people, those programs reach a large share of the population, and it reaches residents who often have the fewest resources to absorb identity theft.

The system had a history. It launched in 2016 under the name Unified Health Infrastructure Project, and its rollout was badly troubled, with benefit delays and backlogs that drew federal scrutiny and litigation. The state later negotiated financial concessions from Deloitte over those failures. By 2024, RIBridges had stabilized, but the relationship between the state and its vendor carried that background into the breach.

The state did not run RIBridges itself. Deloitte, which built and operated the system under contract, had detected suspicious activity earlier in December. It later confirmed that an attacker had likely obtained personal information, including Social Security numbers and some bank account details.

The sequence of notice is part of the story. According to GovInfoSecurity, Deloitte told the state on Friday, December 13, of a “major security threat” to RIBridges, and said there was a high probability that a cybercriminal had obtained files containing personal information. Governor Dan McKee announced the breach publicly that day and briefed reporters again over the weekend. State and federal law enforcement opened investigations. The state’s preliminary list of exposed data included names, addresses, dates of birth, Social Security numbers and certain banking information.

Deloitte’s own statement drew a careful line. It said the claims related to a single client’s system outside the Deloitte network and that no Deloitte systems had been affected. It also noted that the attackers’ listing named “Deloitte UK,” although the incident did not involve UK systems. Each of those statements was accurate as far as anyone knew. Together they described exactly the split this article is about: the system belonged to the state, the operation belonged to the vendor, and the vendor’s corporate network was a separate thing again.

The state directed that the system be taken offline. That decision, made to stop further damage, had an immediate human cost: it pushed applicants to paper and in-person processes. Caseworkers who normally clicked through screens were suddenly handling forms by hand, and residents who were used to applying online had to show up or mail paperwork.

The Brain Cipher ransomware group claimed responsibility and later posted data it said it had stolen. Ransomware groups are criminal operations that break into networks, lock or steal data and demand payment; posting stolen files publicly is a common way to pressure victims and to advertise to future ones.

Brain Cipher claimed to have taken about a terabyte of data and threatened to publish it unless a ransom was paid. State officials said the decision about any payment belonged to Deloitte, in consultation with law enforcement. Researchers had tracked the group since June 2024 and reported that it used a version of the LockBit 3.0 ransomware. By the end of December, officials said the group had begun posting stolen files on its leak site.

The governor’s first advice to residents was practical: freeze credit, contact the credit bureaus and watch accounts closely. At that stage the state said it knew of no identity theft or fraud linked to the breach. Notification letters, with instructions for enrolling in credit monitoring, would follow once the forensic work identified who was affected.

The state arranged credit monitoring for affected people and said it expected the vendor to bear the costs of the response. The state later estimated that about 657,000 people were potentially affected, a very large number for the smallest state in the country.

Rhode Island was not the first state to discover that a contractor’s breach was its own problem. In 2023, the Iowa Department of Health and Human Services reported that nearly 234,000 Iowans had been affected by a hack at MCNA Insurance, a dental benefits contractor. Its incident reached nearly 9 million people across its clients nationwide.

The governor stood at the podium. The vendor held the keys. That split, between who answers to the public and who controls the machinery, is the real story of the week.

Suppose you are the director of a state human services department on a Friday afternoon in December. Your phone rings. The caller is your vendor, since you have no real security team of your own for this system. The news is that something suspicious happened on the platform that serves a large share of your state’s residents. You need to know how bad it is, what was taken, whether to shut the system down, and whom to tell and what to say. Every answer depends on information that sits on someone else’s computers, in someone else’s logs, gathered by investigators someone else hired.

That is the position the RIBridges breach exposed. Many states run benefits eligibility systems through large vendors that design, host and operate them. The model is reasonable. These systems are complex, change constantly with federal and state policy, and require skills states rarely keep in-house. RIBridges showed the gap the model creates during a breach. The public, the legislature and the press held the governor and the agencies accountable. The vendor held the systems, the logs and the forensic evidence, and had legal and commercial interests of its own.

That gap is a procurement problem, and it is closed only in the contract. Four questions together define who controls a breach response: who sees what, who decides what, who pays for what, and whether the state can leave. They do not overlap, and a contract that settles all four leaves no part of the response to negotiation under pressure. Most large state system contracts answer some partially and others not at all.

How a vendor-run benefits system actually works

An integrated eligibility system has three broad layers. At the front is a portal, the website where residents apply, upload documents and check their case. In the middle is the rules engine, the part of the software that encodes eligibility policy, such as income limits and household size, and decides who qualifies for what. Behind both sits a large database holding every applicant’s records, plus connections to federal and state data sources used to verify income, identity and residency.

In a vendor-operated model, the vendor typically builds all three layers, often heavily customized for the state, and then runs them day to day. It may host the system in its own data centers or on a commercial cloud. Its staff apply software updates, implement policy changes, watch for security problems and fix things when they break. The state sets policy, employs the caseworkers who use the system and answers to the public.

The arrangement resembles a large apartment building run by a property management company. The owner is responsible to the city and to tenants. The management company holds the keys, runs the security cameras, employs the maintenance staff and keeps the incident log. Most of the time, that arrangement works well. During a break-in, the owner discovers that the camera footage and the door access records belong to someone else. So does the decision about whether to call in an outside investigator, unless the management contract says otherwise.

Two more pieces of vocabulary are useful. Logs are the automatic records computer systems keep of who logged in, what they did and when. Forensics, in this setting, means the specialist investigation that uses logs and other traces to work out how attackers got in, what they touched and whether they are still there. Without access to both, a state can only repeat what its vendor tells it.

Why states buy these systems this way

The vendor-run model has a financial logic as well as a technical one. Federal law lets states claim enhanced federal matching funds for Medicaid eligibility systems: 90 percent of approved design and development costs, and 75 percent of approved maintenance and operations. To get that money, states submit planning documents for federal review and follow federal procurement and system standards. Food assistance and other programs bring their own federal partners into the approval chain.

That structure favors large, multi-year contracts with a small number of national integrators that know how to build systems the federal partners will approve. It also makes it hard for a state to switch quickly, because any new procurement passes through the same review. CMS has encouraged states for years to build Medicaid systems from separate modules that can be procured and replaced independently, partly to reduce dependence on a single vendor. Integrated eligibility systems remain among the largest and most tightly coupled pieces of state technology.

Duties that stay with the state

Outsourcing the operation does not move the state’s legal obligations. A state Medicaid agency is a covered entity under HIPAA, so its operator is a business associate, and the state remains responsible for breach notification to individuals and to HHS. Eligibility systems that receive federal tax information to verify income must meet the IRS safeguarding requirements in Publication 1075, which include prompt reporting of suspected incidents to federal authorities. Systems connected to the federal data hub used for health coverage must meet CMS security standards for exchanges and Medicaid systems.

Each of those regimes sets its own reporting clock, and the state answers for meeting it. A contract that gives the vendor longer to report than the state’s federal agreements allow puts the state in breach of those agreements on day one of any incident. Mapping every federal and state reporting obligation, and setting the vendor’s notice window inside the shortest of them, is the first task in drafting the visibility terms.

Visibility: who sees what, and when

A state cannot manage what it cannot see. In vendor-operated systems, security monitoring, logs and alerts often sit entirely with the vendor. The state learns of an incident when the vendor tells it, and learns the details at the vendor’s pace and in the vendor’s format.

Contracts should require notice of suspected incidents within hours, not days, and give the state continuous read access to security logs and monitoring dashboards. They should let the state appoint its own forensic investigator with full access to evidence, and require the vendor to preserve that evidence. Where the vendor’s outside counsel directs the investigation to protect privilege, the state should know in advance which reports it will receive, in what form and by when. A state that receives only a summary may be unable to answer its own legislature.

A word on privilege, because it surprises many non-lawyers. When a company’s lawyers commission a forensic investigation, the resulting reports may be shielded from disclosure in later lawsuits. That is a legitimate protection for the company. But it can also mean the customer, here a state government, receives a short summary rather than the full findings. Settling in advance what the state will see avoids an awkward standoff in the middle of a crisis.

Privilege is also less certain than it looks. In the litigation over Capital One’s 2019 breach, a federal court ordered the bank to produce a forensic report prepared by its incident response firm. The court found that the work would have been done for business reasons anyway. Companies responded by structuring investigations more carefully through counsel. For a state, the practical effect is that the vendor’s investigation will be designed with litigation in mind. That is one more reason for the state to have its own investigator with its own reporting line.

Visibility must also reach the vendor’s own suppliers. Large integrators rely on hosting providers, subcontracted developers and support firms, any of whom can be the entry point. The contract should require the vendor to list those parties, flow down the same notice and evidence duties, and tell the state before adding new ones with access to the system or its data.

What continuous access looks like

“Access to logs” can mean very different things. At the weak end, the vendor emails a spreadsheet extract on request. At the strong end, the system’s security events stream in near real time to a monitoring platform the state controls, operated by the state’s security operations center or a provider the state hires. The contract should specify which events are sent, how long they are retained, and that retention continues during and after an incident.

The capacity to use that feed varies by government. A large state with a central security office can watch the stream and correlate it with other agencies’ data. A small state or a county may have a handful of security staff covering everything. For them, the realistic goal is narrower: an independent copy of the logs, held where the vendor cannot alter them, and a retained forensic firm that can read them when needed. Federal grants under the State and Local Cybersecurity Grant Program, created by the 2021 infrastructure law, have helped some governments pay for that kind of capacity.

Visibility in calm periods matters as much as during an incident. The contract should give the state the vendor’s vulnerability scan results, penetration test reports and remediation timelines for the system, along with independent audit reports. A state that reads those regularly knows where the weak points are before an attacker finds them, and it has a baseline against which to judge the vendor’s account when something goes wrong.

Decision rights: who decides what

During a breach, decisions come fast: whether to take the system offline, what to tell the public, whether to engage with attackers, when to restore service, and how to reopen accounts safely. In Rhode Island the state directed the shutdown. That was the right authority, but many contracts never say so explicitly.

The contract should state that the state decides matters affecting public services and public communications, and that the vendor executes those decisions. It should define a joint incident command, agreed before any incident, with named roles and alternates on both sides. It should reserve to the state any decision about payments or communications with attackers, which raise legal and policy questions only the state can answer. And it should set restoration criteria, such as evidence of eradication and a credential reset plan, that the state approves before reopening.

Those last terms deserve translation. Eradication means confirming the attackers have been fully removed, rather than blocked at one entry point while they still hold another. A credential reset plan is the process for making every user choose a new password, so that any passwords the attackers stole become useless. Reopening a system without both leaves the attackers a way back in.

Restoration criteria can be specific without being technical for its own sake. They typically include a written statement from the forensic firm that known attacker access has been removed, rotation of privileged accounts, service account credentials and encryption keys, and rebuilding of any compromised administrative servers. They add multi-factor authentication for every staff account and a period of heightened monitoring after reopening. Researchers have reported that Brain Cipher, like many ransomware groups, often goes after administrator credentials once inside a network. Restoration criteria that do not address privileged access leave the most valuable door unlocked.

The shutdown decision shows the stakes. Taking a benefits system offline stops further theft, but it also means families cannot apply for food assistance or renew health coverage online. Those are not technical trade-offs. They are policy choices with real consequences for vulnerable residents, and they belong to elected and appointed officials. A vendor may be best placed to execute a shutdown quickly, but it should not have to wonder whether it has the authority to do so. The state should never have to argue that it does.

Ransom decisions and the data owner

Rhode Island’s handling of the ransom question shows why decision rights need writing down. State officials said the decision about any payment belonged to Deloitte, in consultation with law enforcement, and the governor said Deloitte had been in contact with the group. The data at stake belonged to the state’s residents. The decision about whether to pay for its suppression rested, by the state’s own account, with the vendor.

There are reasons a state might prefer that arrangement, including keeping public money away from criminals. There are also reasons it might not. Some states, including North Carolina and Florida, have passed laws barring state agencies from paying ransoms. The Treasury Department’s sanctions office has warned that paying ransoms to sanctioned parties can violate federal law. A state with a no-payment policy needs its contract to say whether the vendor may pay on its own account to protect the state’s data, and whether the state must be told first.

Communications as a decision right

Public communication is the decision right most often contested in practice. The vendor wants to protect its other clients and its legal position. The state wants to tell residents what happened and what to do. Notification letters, call center scripts, the web page and press briefings all need content both sides agree is accurate. Agreeing in advance that the state owns the message and the vendor supplies verified facts within a set time avoids a draft-and-redraft cycle while residents wait.

Federal partners belong in the plan too. The Medicaid agency’s federal contacts at CMS, the food assistance program’s contacts at USDA, and the IRS for any federal tax information each expect notice, and each will ask how benefits will continue. A contact list for those partners, held by the state and tested in exercises, is as important as the vendor’s escalation list.

Costs: who pays for what

Breach costs include forensics, legal advice, notification, credit monitoring, call centers, manual processing while systems are down, and restoration. Whether a state recovers them depends on the contract.

Contracts should specify which costs the vendor bears when a breach arises from its systems or failures. Limits of liability deserve particular scrutiny. A limit of liability, or cap, is a clause that sets the most a vendor can be made to pay if things go wrong. Caps tied to a fraction of annual contract value can sit far below the cost of a breach affecting a large share of a state’s residents. A better approach sets a separate, higher cap for data security incidents, sized against realistic per-person response costs for the population served. Cyber insurance requirements, with the state named as an additional insured where appropriate, give the cap something to draw on. States should take counsel’s advice on these terms.

Some rough arithmetic shows why sizing matters. Suppose a state’s eligibility contract caps the vendor’s liability at a fraction of one year’s fees. Now suppose a breach touches several hundred thousand residents. Multiply that population by even a modest per-person cost for notification letters, call center time and credit monitoring, then add forensics, legal work and weeks of manual processing. The total can easily exceed the cap, leaving the state, and in the end taxpayers, to cover the difference.

Cost recovery also depends on records the state keeps itself. Overtime for eligibility workers processing paper applications, extended call center hours and temporary staff are real costs, but they are easy to lose in normal budgets. A cost code opened on the first day of an incident, used by every affected agency, makes the claim against the vendor or insurer defensible later. A cost code is simply an accounting label that tags spending to a particular purpose, so that it can be totaled and documented afterward.

Costs that are unique to public programs

Some costs of a benefits system outage have no private-sector equivalent. When Rhode Island’s health exchange was offline, the state arranged to enroll about 2,000 customers directly with two health plans for January and February 2025, and part of Deloitte’s later payment went toward that. Food assistance and cash benefits have issuance dates set by program rules. Officials said they expected January payments to go out on time, and meeting those dates while the system was down took manual work.

Federal funding adds a question. Ordinary operating costs of a Medicaid eligibility system qualify for federal matching funds. Whether particular breach response costs qualify, and how vendor reimbursements are credited back to federal partners, is something a state should settle with them early rather than discover during an audit.

The case against a higher cap

A higher liability cap is not free, and the objections deserve weight. Vendors will raise their bid prices to cover the added risk or the insurance needed to back it. Some may decline to bid, and in a market with few qualified integrators, losing even one bidder weakens competition. Cyber insurance markets also limit how much cover a vendor can buy at a reasonable price.

Those trade-offs argue for precision rather than maximal terms. A cap sized to realistic per-person response costs, rather than to an arbitrary multiple of fees, is easier for a vendor to insure and price. A separate cap for incidents caused by the vendor’s failure to meet specified security obligations ties the risk to things the vendor controls. And a state that keeps good records of its own costs, and holds credible exit rights, recovers more under any cap than one that does not.

Exit: whether the state can leave

The fourth question is the one states least want to ask and most need to. If trust in a vendor breaks, can the system move to another operator? In practice, eligibility systems are heavily customized, and the knowledge to run them rests with the vendor’s staff.

Credible exit requires complete, current documentation; ownership or a perpetual license for custom code and configurations; regular data exports in usable formats; and defined transition assistance with rates fixed in advance. A state that never uses these rights still benefits from holding them. They change the balance of every negotiation, including the cost discussion during an incident.

Consider the alternative. A state that cannot realistically leave has little bargaining power of any kind. It cannot credibly threaten to rebid the contract or bring in a second firm to take over part of the work. It must accept whatever price and pace the incumbent offers for every future change. Exit rights are rarely used, but they change how everyone behaves.

Code and data are the easy part of exit. The harder part is knowledge: how the rules engine encodes decades of policy exceptions, which batch jobs run in which order, and why particular workarounds exist. Contracts can require operations manuals and current runbooks, named key personnel who cannot be moved without notice, and a duty to cooperate with a successor during transition. Some states also keep a small team of their own product owners and analysts who work alongside the vendor, so that understanding of the system lives inside government as well.

Modularity helps exit and complicates response

Breaking a system into separately procured modules, as CMS has encouraged, makes exit more realistic. A state can replace the portal without replacing the rules engine, or move hosting without rewriting the software. It also changes incident response. With several vendors, a breach may cross contractual boundaries, and each vendor will want to show that the problem began elsewhere.

A modular state therefore needs a systems integrator role, either in-house or contracted, and a single incident command that binds all vendors. Each contract should carry the same notice, evidence and decision terms, and require vendors to cooperate with each other’s investigators. Without that, modularity trades one vendor holding the evidence for several vendors each holding part of it.

Vendors will price these terms, and that is appropriate. The alternative is paying later, in unrecovered costs and in bargaining power the state does not have when it needs it.

A tabletop scenario: the first 72 hours, two ways

A tabletop exercise is a rehearsal in a conference room: leaders walk through an imagined incident, hour by hour, to see where the plan breaks. Say a county agency runs the same imagined breach under two different contracts.

The weak contract. The vendor calls on day two, a day after its own team first saw something odd. The county asks for logs and is told they are being reviewed by the vendor’s outside counsel. The county’s chief information officer wants to bring in an independent investigator, but the contract is silent, so the request goes to the vendor’s legal team. A debate opens about whether the county or the vendor should decide to take the portal offline. Meanwhile, the county’s finance office has no way to tag the overtime its caseworkers are already working. By day three, the county executive faces reporters with only a two-paragraph summary to go on.

The strong contract. The vendor calls within hours, as required. The county’s security lead already has read access to the monitoring dashboard and can see the alerts directly. The pre-agreed incident command convenes, with named people on both sides. The county exercises its right to appoint its own forensic firm, which receives preserved evidence. The county decides to take the portal offline and tells the public itself; the vendor executes. Finance opens an incident cost code that afternoon. By day three, the county executive can describe what is known, what is not yet known, and when the next update will come.

The breach is the same in both versions. The difference is entirely in what was agreed before it began.

Days four to thirty

A good exercise continues past the first three days, because the hardest decisions come later. The team has to decide when the forensic findings are firm enough to identify affected people and start notification, and how to staff a call center for hundreds of thousands of letters. It has to decide what the restoration criteria are, who signs off, and how residents will regain access to accounts safely. Benefit issuance dates do not move, so the plan must show how payments continue while the system is partly down.

Rhode Island’s recovery gives a realistic shape for those weeks. Staff access came back first, in early January. Customer access came later, through staged password resets. Each stage needed criteria that the state approved and the vendor met. An exercise that rehearses those handoffs, with the actual people from both organizations, tests whether the contract’s decision rights work outside a conference room.

The same split in hospitals, banks and insurers

The same structure appears far outside state benefits. Hospitals outsource electronic health records and revenue cycle operations. Banks outsource core processing and card platforms. Insurers outsource claims administration. In each case, the organization carries the regulatory and reputational accountability while a vendor holds the systems and the evidence.

For a board or senior leadership team, the RIBridges questions translate directly. When something goes wrong in an outsourced system, regulators, customers and the press will come to you, not to your vendor. Your ability to answer them, to make fast decisions, to recover your costs and to change course if needed was fixed the day the contract was signed. That makes the contract a risk document as much as a commercial one.

How the rules differ by sector

The legal framing differs in each sector, but the four questions carry across. Banks have a specific rule. Under the federal interagency incident notification rule, a bank service provider must promptly notify affected bank customers when an incident has disrupted, or is likely to disrupt, covered services for four or more hours. The bank itself must notify its regulator within 36 hours of determining a notification incident has occurred. Credit unions face a 72-hour reporting rule from the NCUA.

Health systems have HIPAA’s business associate framework, which requires business associates to report breaches to the covered entity but leaves the timing, beyond an outer limit of 60 days, to the contract. Insurers in states that have adopted the NAIC Insurance Data Security Model Law must oversee third-party service providers and notify their insurance commissioner of certain cybersecurity events within 72 hours. Counties running criminal justice systems through vendors must meet the FBI’s CJIS Security Policy, which requires vendors with access to criminal justice information to meet the same standards.

Within government, the structure varies too. In states where counties administer benefits, the state or a county consortium often holds the system contract while counties employ the caseworkers. That adds a third party to every decision about shutdown, communication and cost. A county director in that position needs to know which of the four questions the state’s contract answers on the county’s behalf, and which it leaves open.

In each case, the regulator’s clock binds the organization, not the vendor. A contract that is looser than the regulatory clock transfers no risk. It only guarantees the organization will be late.

Terms worth negotiating for

For vendor-operated critical systems, the stronger contracts tend to include the following.

• A short incident notice window, measured in hours, and continuous access for the organization to security logs and dashboards.
• The right to bring in an independent forensic firm, with evidence preserved and a clear list of reports the organization will receive.
• A written incident command structure, agreed and rehearsed in advance, with the organization holding authority over shutdown, communications, attacker contact and restoration.
• A dedicated liability cap for security incidents, sized to the population served, backed by insurance.
• Documentation, code rights, regular data exports and priced transition support that make leaving a real option.

The usual failures start with accepting the vendor’s standard contract terms for a system that serves an entire state, and treating security as the vendor’s problem because the vendor runs the system. Others are never rehearsing an incident jointly, leaving liability caps at a fraction of annual fees, and assuming exit is impossible, so never negotiating for it. Another frequent error comes at the end of an incident: rushing to reopen without a credential reset plan, which invites a second wave of trouble. The approach taken in Rhode Island, sending password reset messages without links, is a useful counterexample.

The evidence an auditor will ask for

State auditors and legislative oversight committees tend to arrive after an incident, and they ask for documents rather than intentions. A state that has done this work can produce the contract clauses for notice, evidence, decisions, costs and exit, and records of the last joint exercise with the actions that followed. It can show proof that the log feed was live before the incident and the retainer with its own forensic firm. It can also produce the incident cost code report and a reconciliation against vendor reimbursements.

Simple measures help a program track its own progress between incidents. Useful ones are the share of vendor-run critical systems with a notice window shorter than every applicable federal clock, and the share with an independent log copy. Add the date of the last joint exercise for each system and the number of systems with a tested exit plan. The measures require no new technology. Each requires someone in the agency to own it.

The case for leaving it to the vendor

A serious counter-argument holds that states should not try to run incident response for systems they do not operate. The vendor has the engineers, the tools and the knowledge of the system. A state that insists on appointing its own forensic firm, approving every restoration step and holding a live log feed may slow the response and duplicate effort.

That concern is reasonable, and the answer is to separate execution from authority. The vendor should run the technical response. The state should hold the decisions that affect residents and public money, and the information it needs to make them. A state with read access to logs does not need to analyze them during the incident. It needs to be able to check the vendor’s account afterward and answer its legislature with evidence rather than a summary.

Before the phone rings

A practical sequence works from the contract calendar. For contracts renewing in the next year, the four sets of terms should be part of the renewal negotiation. For contracts with years left to run, a joint incident plan and a log-sharing arrangement can often be agreed as amendments without reopening price. For new procurements, the terms belong in the solicitation, so that every bidder prices them and none can claim surprise. The questions below show which of those tracks each system needs.

1. For each system a vendor runs on our behalf, how quickly must the vendor tell us about a suspected incident, and is that in writing?
2. Can we see the security logs ourselves today, or only when the vendor sends us a report?
3. Who has the authority to take the system offline, and who speaks to the public?
4. What is the vendor’s liability cap, and how does it compare with the cost of a breach affecting everyone we serve?
5. If we had to move this system to another operator, do we have the documentation, code rights and data to do it?

With hindsight

State staff regained access to RIBridges in early January 2025. From late January, customers received password reset emails in waves, deliberately sent without links to reduce phishing risk, and the public portal was largely back by February. By February 4, new users could sign up again. The estimate of about 657,000 potentially affected people came in January, from the ongoing forensic analysis of which parts of the network had been accessed.

The recovery shows the state making the decisions this article argues it should own. It chose the order of restoration, starting with the staff who process cases. It set the terms on which residents would return to the portal. It arranged a temporary direct enrollment with health plans while the exchange was down, and it kept January food and cash payments on schedule. Each of those steps depended on information and execution from the vendor, but the choices were public ones.

That detail about links is worth dwelling on. Phishing is the practice of sending fake messages that look legitimate to trick people into handing over passwords or clicking malicious links. After a well-publicized breach, criminals often send their own “reset your password” emails to exploit the confusion. By sending genuine messages without links, the state gave residents a simple rule: any message with a link is not from us. Other organizations can borrow that small, smart choice.

In early February the governor’s office announced that Deloitte had paid the state $5 million toward its additional costs, on top of paying for credit monitoring and identity protection for those potentially affected. No breakdown of the state’s response costs was given at the time. Whatever the full figure, the payment illustrated the cost question this article raises: what a state recovers depends on what the contract says and on how well the state has documented its own spending.

Other public programs met the same structure in the months that followed. In January 2025, a cyber incident at Conduent, a contractor that processes payments for many state programs, delayed some benefit and child support payments in several states. Around the same time, PowerSchool, which hosts student information systems for many school districts, disclosed a breach of data its customers held on its platform. In each case, the public body answered to residents for a system it did not run.

Pressure on vendor-run eligibility systems then grew for a different reason: the 2025 federal budget law changed Medicaid and SNAP eligibility rules, requiring substantial system modifications. That made contract terms on visibility, decision rights and exit more valuable, since states had to direct major changes through the same vendors.

The scale of that work is clear from the law itself. It requires states to apply work and community engagement requirements to many adults in the Medicaid expansion group, due to begin by the start of 2027, subject to possible extensions. It requires more frequent eligibility redeterminations for that group. It also ties a share of each state’s SNAP benefit costs to its payment error rate, which puts a price on eligibility mistakes. Every one of those changes runs through the rules engine of an integrated eligibility system, and in many states that means through the vendor that operates it.

That gives the contract terms a second use. The visibility, decision and exit rights that protect a state in a breach also govern how fast, at what price and with what evidence a vendor delivers a policy change. A state that cannot see inside its system, or cannot credibly take its business elsewhere, is negotiating both kinds of event from the same weak position.

In any sector, outsourcing a critical system moves the work but not the accountability. The time to decide who sees, who decides, who pays and whether you can leave is before the phone rings, not after. Those terms cost something to negotiate, and vendors will price them. Measured against weeks of paper processing, hundreds of thousands of worried residents and a public that holds elected officials responsible, they are among the better bargains in public technology.