RIBridges Data Settlement: Eligibility, Payouts, and Timing

The RIBridges data breach settlement is a $6.3 million class action resolution with Deloitte Consulting LLP, approved by a federal judge on January 29, 2026, that pays affected Rhode Islanders either reimbursement of documented losses up to $5,000 or an estimated $100 flat payment, with two years of medical data monitoring available on top of either option.¹² The case is Pannozzi v. Deloitte Consulting LLP, filed in the U.S. District Court for the District of Rhode Island, and 47,140 people filed claims by the January 14, 2026 deadline.³

Who Is Covered

The settlement class includes all living U.S. residents who received a notice from the State of Rhode Island saying their private information may have been affected by the 2024 RIBridges breach.¹ Notices went out to 729,946 individuals.³ The final count of people whose data was actually exposed was 644,401, after an initial estimate of roughly 657,000 was revised when some recipients were found to have no exposed information and others were newly identified.⁴

Deloitte denied all liability and wrongdoing as part of the agreement.¹ Only 35 people opted out of the class, and no objections were filed.³

What Claimants Receive

Class members who filed a valid claim by January 14, 2026 chose between two cash options.⁵

Cash Payment A reimburses documented out-of-pocket losses tied to the breach, such as identity theft expenses, up to $5,000. It requires supporting documentation like receipts, phone records, or account statements.
Cash Payment B is a flat payment estimated at $100 and requires no documentation.

Both options are subject to pro rata adjustment depending on how the total value of valid claims compares to the net settlement fund, so final checks can be higher or lower than the stated figures.⁵

Separate from the cash choice, every class member can claim two years of medical data monitoring through CyEx’s Medical Shield product. The service tracks healthcare plan IDs, medical record numbers, health savings accounts, and dark web activity, and it includes $1 million in identity theft insurance with no deductible.⁶⁷

The settlement also set aside up to $2.1 million for attorneys’ fees and $2,500 service awards for each of the seven named plaintiffs: Ronald J. Pannozzi, Paola Baldomar, Meredith Brandt, Monica Depina, Meghan Konopka, Joan Ratcliffe, and Renee Trigueiro.⁵⁸

When Payments Go Out

U.S. District Judge Melissa R. DuBose held the final fairness hearing on January 29, 2026 and approved the settlement that same day. Formal judgment was entered on January 30, 2026, and the case was terminated.²

As of mid-2026, the settlement website says payment distribution will begin after the time for appeals has expired and all claim forms have been processed. No specific mailing dates for checks have been announced.⁹

The claim filing deadline has already passed. If you did not submit a claim by January 14, 2026 and did not opt out, you remain bound by the settlement’s releases but will not receive a payment.

What Data Was Exposed

RIBridges is Rhode Island’s centralized system for Medicaid, SNAP, and the HealthSource RI insurance marketplace, built and managed by Deloitte. In July 2024, an international cybercriminal group called Brain Cipher used stolen credentials belonging to a Deloitte employee to enter the system through a VPN connection and remained undetected for roughly five months.¹⁰

The compromised information included names, addresses, dates of birth, Social Security numbers, banking information, phone numbers, and health records.¹¹ After no ransom was paid, Brain Cipher published the stolen data on the dark web on December 30, 2024.¹² That exposure is what the medical monitoring benefit is designed to flag going forward.

Rhode Island separately offered free credit monitoring through Experian to affected individuals, but the enrollment window for that program closed on October 17, 2025.¹³

The State’s Separate Settlement Is Not for Individuals

Rhode Island reached its own financial recovery from Deloitte over the same breach, and it is easy to confuse with the class action. Deloitte paid the state $5 million in February 2025, and on April 24, 2026, Governor Dan McKee announced an additional $7 million settlement, bringing the state’s direct recovery to $12 million. Deloitte also provided $6 million in system enhancements, operational support, and business continuity services at no charge.¹⁴

That money went to the state to cover its own breach-related costs. It is not distributed to residents. Individual payments to Rhode Islanders come only from the $6.3 million class action fund.¹⁵ The class action settlement also protected the state as a “released party,” meaning individuals who did not opt out of the class gave up any related claims against Rhode Island itself.

1
Rhode Island Current. Deloitte Reaches $6.3M Deal to Settle Class Action Lawsuit in RIBridges Data Breach
2
PACER Monitor. Pannozzi v. Deloitte Consulting LLP
3
teiss. More Than 47,000 Claims Filed in Class Action Over 2024 RIBridges Data Breach
4
Governor of Rhode Island. Third-Party Findings on RIBridges Data Breach Released
5
Rhode Island Current. Deadline to Submit Claims for RIBridges Data Breach Settlement Is Jan. 14, 2026
6
RIBridges Data Settlement. Pannozzi v. Deloitte Consulting LLP Settlement
7
CyEx. Medical Shield
8
Classaction.org. Pannozzi v. Deloitte Consulting LLP – Settlement
9
RIBridges Data Settlement. Pannozzi v. Deloitte Consulting LLP Settlement – FAQ
10
Bank Info Security. Rhode Island Slams Deloitte Over RIBridges Data Breach
11
Classaction.org. Pannozzi v. Deloitte Consulting LLP – Notice
12
Rhode Island Current. Brain Cipher
13
Rhode Island Department of Administration. RIBridges Alert
14
Governor of Rhode Island. Governor McKee Announces Finalization of Settlement With Deloitte Related to RIBridges
15
Rhode Island Current. State Announces $7 Million Settlement With Contractor Deloitte Over RIBridges Cyber Breach