Rhode Island officials addressed the state last week to deliver the news of a large-scale cybersecurity incident affecting the RIBridges system.

RIBridge is a critical piece of Rhode Island’s infrastructure. Its systems power Medicaid, Supplemental Nutrition Assistance Program (SNAP), Child Care Assistance Program (CCAP), Temporary Assistance for Needy Families (TANF), and other general healthcare programs.

The breach involved sensitive data for many of its customers. While the full scope of the breach is still under investigation, Deloitte, the state’s official vendor, wrote that it involved social security numbers, names, addresses, dates of birth, and even some banking data.

The official website was also temporarily taken down. Users cannot log in through the mobile app or web portal until the situation is resolved.

The worst part is that the attack wasn’t entirely without warning. The state’s auditor general had been warned for years that the system was vulnerable. Audits revealed that Rhode Island doesn’t have enough resources being spent on cybersecurity. It was an open secret that Rhode Island systems were waiting to be hacked.

According to officials, Deloitte became aware of the incident on December 5th and immediately began taking action by implementing additional security features. Concrete evidence of the breach was obtained on Dec. 10 based on a screenshot of a file folder that the hackers sent back to Deloitte.

Two days after the screenshot was seen, malicious code was observed in RIBridges systems. This prompted Deloitte to bring down the user portal. It’s already likely that sensitive user data was involved in the breach.

In response, Deloitte opened a dedicated call center that users affected by the breach can use to get assistance.

As of now, it’s unknown which hacking group attacked Rhode Island or if they’re using the stolen data for fraudulent activity. There has not been any evidence of malicious activity yet, but it’s important to stay alert and use an identity monitoring service to ensure that criminals aren’t using your data.