Deloitte Agrees to $6.3 Million Settlement Deal in Public Benefits Hacking Incident

Posted on by Going Concern News Desk
An external Deloitte sign

It hasn’t been approved by a federal judge yet but Deloitte has agreed to pay $6.3 million in a class action suit consisting of hundreds of thousands of people whose information was compromised in a 2024 breach of Rhode Island public benefits systems, with the caveat that Deloitte denies all liability and wrongdoing. Deloitte built and still manages the RI Bridges system that was compromised in 2024.

See earlier:

The breach affected not only recipients of benefits such as SNAP (food stamps) and/or Medicaid but also people who purchased health coverage through HealthSource RI, among others. The specifics, according to an alert published by the state of Rhode Island and regularly updated with any new information:

  • In July 2024, a threat actor gained entry to the RIBridges system through unauthorized use of Deloitte credentials.
  • Between July and November 2024, the actor accessed 28 systems in the RIBridges environment.
  • Between November 11 and 28, 2024, the actor exfiltrated numerous files from the system.
  • After November 28, the actor was no longer present in the system.

It appears the breach was discovered when the group responsible reached out with demands in December of 2024 and threatened to release the data they lifted.

In their coverage of the settlement, Rhode Island Current said members of the class action could receive $100 each with no documentation, perhaps less after legal fees, and up to $5,000 if they can prove they were directly impacted through identity theft or other related damages. They also said:

The settlement agreement notes that “Deloitte denies all liability and wrongdoing,” and the agreement shields the company from future litigation by people who do not send a request to opt out, whether or not they submit a claim.

Tim Rondeau, a spokesperson for Rhode Island Attorney General Peter Neronha, said via email Friday that “The State is not a named party to this action and did not participate in this settlement.” But the deal does shield the state — by declaring it a “released party” — and its agencies from any related lawsuits by class members who don’t opt out of the settlement.

Peter Wasylyk, one of the lawyers representing the affected class, said the several law firms in this case will be seeking up to $2.1 million in fees.

Settlement agreement below, we’ll update if/when it’s finalized.

Deloitte RI Bridges settlementDownload

Related Posts

Deloitte Resigns as American Apparel Auditor; Hotness of Engagement Team Presumably Not an Issue

So for those of you that aren’t too fashion conscious, you probably don’t the name Dov Charney. He’s the Chairman and CEO of American Apparel and you’d be hard pressed to find something in one of his stores that qualify under your firm’s dress code.

Nevertheless! AA is a publicly traded company and is subjeities laws as everyone else. Last year they opted to drop Marcum as their auditor for Deloitte. One year later, the firm has apparently had all they can stand of AA because they resigned today, citing possibly unreliable financial statements for 2009, sending the company’s stock reeling.


The 8-K has the usual language that you would expect from a typical auditor/client break-up but here are the gory details for those you that enjoy that sort of thing (citations omitted and extra fun stuff is bolded):

During the period from April 3, 2009 through July 22, 2010, there were no “reportable events” except that (i) in Deloitte’s report dated March 31, 2010 (which was included in the 2009 Form 10-K) on the Company’s internal control over financial reporting as of December 31, 2009, Deloitte identified material weaknesses in internal control over financial reporting related to the control environment and to the financial closing and reporting process, which are further described under Item 9A in the Company’s 2009 Form 10-K, and advised that the Company has not maintained effective internal control over financial reporting as of December 31, 2009; and (ii) Deloitte advised the Company that certain information has come to Deloitte’s attention, that if further investigated may materially impact the reliability of either its previously issued audit report or the underlying consolidated financial statements for the year ended December 31, 2009 included in the Company’s 2009 Form 10-K. Deloitte has requested that the Company provide Deloitte with the additional information Deloitte believes is necessary to review before the Company and Deloitte can reach any conclusions as to the reliability of the previously issued consolidated financial statements for the year ended December 31, 2009 and auditors’ report thereon.

As we mentioned, this has spooked plenty of people, including Ed Yruma an analyst at KeyBanc quoted by Bloomberg in a letter to investors, “The company has struggled since its IPO with both its internal controls and its ability to file SEC filings on a timely basis. An ability to file SEC filings on a timely basis has been an ongoing issue.”

Back to the superficial. Dov Charney is, what you might call, a character. Here’s a brief chat we had with Nick, Breaking Media web developer and occasional contributor to our sister site Fashionista:

me: When i say the name
Dov Charney
your response is…
Nick: LECH
PERV

You only need to snoop around the web briefly (e.g. here, here, here) to pick up what Nick is referring to.

Deloitte’s letter to the SEC is brief and makes no mention about the plethora of models not wearing pants or Dov judging the young auditors’ hot or not-ness, so that likely wasn’t part of the problem. Anyhow, AA ran straight back to Marcum who might be more comfortable with, what we imagine to be, an interesting work environment.

8-K [SEC]
American Apparel Falls After Deloitte Resigns as Accountant [Bloomberg BusinessWeek]

Deloitte Resents the Notion That They Should Have Known That Taylor, Bean & Whitaker Was a Massive Fraud

As we mentioned briefly, Deloitte has been sued for $7.6 billion by the bankruptcy trustee of Taylor, Bean & Whitaker and Ocala Funding, LLC. If you’ve never heard of Taylor, Bean & Whitaker then check out Jr. Deputy Accountant who’s been all over it since the Feds starting kicking down the doors. Long story short – TBW was a giant fraud perpetrated by its management, Colonial Bank owned a lot of TBW’s mortgages, Colonial failed, Bank of America bought up a bunch of the mortgages, Fannie Mae says they’re owed money, CHRIST, it’s a mess.

Anyhoo, Steven Thomas, who is known for suing the pants of Big 4 firms (and BDO!), is the lead attorney for the plaintiffs and it sounds like the age-old story of auditors BEING COMPLETE IDIOTS:

“Deloitte missed this fraud because it simply accepted management’s conflicting, incomplete and often last-minute explanations of highly-questionable transactions, even though those explanations made no sense and were flatly contradicted by documents in Deloitte’s possession,” one of the lawsuits says.

Of course Deloitte isn’t amused by this, as Deloitte spokesman Jonathan Gandal’s statement attests:

Gandal said the blame for the fraud and losses should rest squarely on Taylor Bean, Ocala Funding and Farkas. “The bizarre notion that his engines of theft are entitled to complain of injury from their own crimes and to sue the outside auditors they lied to defies common sense, not to mention the law,” Gandal said on behalf of Deloitte.

If this statement strikes you as a little confusing, then you’re not alone. First off, when Mr. Gandal is referring to the “the law” he’s probably referring to this. In less legalese, basically what Deloitte is saying is that Lee Farkas and his merry band of crooks are the ones responsible for this shitshow not the Green Dot and therefore, this whole thing is ludicrous. I mean, come on guys, what could a firm that just reported nearly $29 billion in revenue could possibly have done differently? Crooks are just far too smart far auditors. Just ask one.