ACLU sues RIPTA, UnitedHealthcare over data breach that affected thousands of RI workers

The ACLU of Rhode Island is filing a class-action suit against the Rhode Island Public Transit Authority and UnitedHealthcare of New England over a data breach that compromised thousands of state employees’ personal data last year.

ACLU of RI executive director Steven Brown said Tuesday that the goals of the lawsuit are to obtain financial compensation for the victims of the August 2021 breach and “get answers as to how this happened.”

More than a year has passed, he noted, “and we still don’t have answers to many basic questions about the incident.”

The lead plaintiffs named in the lawsuit are Alexandra Morelli, a Coventry resident who has worked at the University of Rhode Island since 2016, and Diane Cappalli, who worked as a scheduling coordinator at RIPTA at the time of the breach and has since retired to Florida.

More: Why RIPTA decided to pay $170,000 to hackers who broke into its computers

This January, fraudulent transactions were made with Morelli’s Kohl’s credit card, according to the lawsuit. The next month, there was suspicious activity on her Target and GAP credit cards. Additionally, a total of $29,999 was withdrawn from her bank account without authorization in February and March.

“This entire experience was and has continued to be extremely frustrating,” Morelli said at a news conference Tuesday at the ACLU’s Providence office, noting that she had been in the process of planning her wedding. She said that the timing of the fraudulent activity convinced her that it was linked to the data breach: “I’ve never had anything like this happen to me before.”

In total, more than 20,000 current and former state employees were impacted by the breach.

Officials have said that the hackers took over RIPTA’s computer system and gained access to files that contained information about people covered by the state’s health care plan. Those files contained Social Security numbers as well as insurance claim information on some people.

Previous RIPTA data breach coverage:

• Number affected by RIPTA breach rises to 22,000; UnitedHealthcare is no-show at hearing

• Rattled by RIPTA breach that affected 22,000, lawmakers propose policy changes

Earlier this year, RIPTA said that the breach compromised the personal health information covered by HIPAA for slightly more than 5,000 people.

The files dated from the period of time when the state used UnitedHealthcare to administer its health care plan; it has since switched to BlueCross BlueShield.

"Protecting member privacy is a top priority, and we continue to work with multiple parties to understand the data breach that impacted the Public Transit Authority’s computer system," UnitedHealthcare spokeswoman Sara Mann said Tuesday. "We were privileged to serve the State of Rhode Island employees and their families until December 2019 and will continue to cooperate with the Office of the Attorney General as they investigate this matter.

RIPTA spokeswoman Barbara Polichetti wrote in an email, "We have not been notified of or served with a lawsuit from the ACLU of Rhode Island. We have no comment at this time."

Peter Wasylyk, lead attorney in the lawsuit, said that it was “totally incomprehensible” that one of the largest health insurance companies in the nation would have given RIPTA unencrypted data that contained sensitive information.

Although the breach took place in August 2021, state employees were first notified about the incident in December 2021. State law requires notification within 45 days. They were not notified about what specific information was taken, Brown said, and the initial notice indicated that the breach involved only RIPTA employees.

More: Rhode Island sewer-system operator hit by cyber attack

“To this day, it remains unclear how and why UHC provided RIPTA with the personal and health care information of non-RIPTA state employees, and why it took over four months for RIPTA to notify both their employees and other affected individuals that their information had been hacked,” the ACLU said in a news release.

The lawsuit contends that both RIPTA and UHC failed to properly secure state employees’ personal information, and did not meet the standards required by federal law. As a result, it says, the plaintiffs have had to spend a “great deal of time and effort” canceling credit cards and debit cards, contacting banks, monitoring financial accounts, disputing unauthorized purchases and battling identity theft.

The ACLU has set up an email address, RIPTA DATA BREACH@riaclu.org, for anyone who has been affected by the breach.

“If we don’t get these answers," Brown said, "then we think it will be way too easy for something like this to happen again."

This article originally appeared on The Providence Journal: ACLU sues RIPTA, UnitedHealthcare over breach of state workers' data