AccidentalGovernmentGovernmentMisdeliveryCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)HighContained

State of Rhode Island

bd_49c6446ac449cc71 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 28, 2026

Filed

Mar 20, 2026

To disclose

20 days

Affected

18,000state residents only

Confidence

66%

Full breach record for State of Rhode Island →2 incidents on file

Rhode Island Department of Administration notified the RI Attorney General on March 20, 2026, regarding a misdelivery incident involving Form W-2Cs mailed to approximately 18,000 state employees and retirees. Starting February 25, 2026, some envelopes were transparent, potentially exposing Social Security Numbers. The State discovered the issue on February 28, 2026, corrected the envelope opacity, and is providing 5 years of free credit monitoring via Experian to affected individuals.

J jump to incidentP pin to compareR raw source

Rhode Island clock✓ RI AG ≤45d20 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 20 days

Feb 25, 2026

Begins

Feb 28, 2026

Discovered

Mar 20, 2026

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed18,000 affectedView incident

Name: Rhode Island Department of Administration
norm: rhode island department of administration

Name: State of Rhode Island
norm: state of rhode island
Industry: Governmentllm

Discovered: Feb 28, 2026
Breach occurred: Feb 25, 2026
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 20, 2026
Affected individuals: 18,000state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1530 Data from Cloud Storage Object
Regulator citations: Notified Rhode Island Attorney General Peter F. Neronha in accordance with R.I. Gen Laws § 11-49.3-4(a)(2)(i)

During the incident: Secured Experian to provide a dedicated call center, credit monitoring, and other remediation services
Distributed individual notifications to potentially affected individuals through U.S. mail, postage pre-paid, and in security envelopes
Changes made: Ensured that all subsequent envelopes used for mailing W-2C forms were appropriately opaque
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: RI AG ≤45d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://riag.ri.gov/media/8586/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 20, 2026
Raw hash: e0dd2ba3f7660df7c92944655585df92cee75420e831ccea0a178712a49fc54a

Reporting entityRhode Island Department of Administration

Victim entityState of Rhode Island

Incidentdiscovered Feb 28, 2026

Stated responseSecured Experian to provide a dedicated call center, credit monitoring, and other remediation services

ComplianceRI AG ≤45d

Extraction provenanceno artifact recorded

Source provenanceriag.ri.gov