EY & Bank of America $2.5M MOVEit Data Breach Class Action Settlement

Data Breach · MOVEit · Claims Open

Current Status

Claims are open. The deadline to file is October 8, 2026, online or postmarked. The deadlines to exclude yourself or object both passed on September 8, 2026.

The Final Approval Hearing is scheduled for October 15, 2026 at 1:00 p.m. in Courtroom 17 of the federal courthouse at 1 Courthouse Way in Boston, before Judge Allison D. Burroughs. No final approval order has been entered and no payment date has been announced.

If you received a notice from Ernst & Young about the 2023 MOVEit incident, filing a Claim Form is the only way to get money from this settlement.

What Changed Recently?

The Court preliminarily approved a settlement under which Ernst & Young LLP and Bank of America Corporation will pay $2,500,000 into a settlement fund, and the administrator began mailing notices carrying a Claimant ID and PIN. The fund pays valid claims along with notice and administration costs, a service award to the class representative, and Class Counsel's attorneys' fees and expenses.

One detail matters for anyone tracking the wider MOVEit litigation: this settlement resolves the claims against EY and Bank of America only. Claims against Progress Software Corporation, which licensed the MOVEit Transfer software, have not been resolved, and that litigation continues.

Both defendants deny any allegation of wrongdoing and deny that the plaintiff would prevail or be entitled to relief if the case were litigated. No court has found either company liable.

Who Qualifies?

You are a settlement class member if you are a living person in the United States whose personally identifying information was included in the files affected by the MOVEit Security Incident — specifically, Bank of America customer data that Bank of America had provided to Ernst & Young.

The settlement class excludes the defendants, any entity in which they have a controlling interest, and their officers, directors, legal representatives, successors, subsidiaries and assigns; any judge, justice or judicial officer presiding over the litigation, along with their immediate families and judicial staff; and anyone who timely and validly opted out.

In practice, the people in this class are Bank of America customers who received a notice letter from EY. If you never received a notice but believe your data was involved, the Settlement Administrator is the party that determines eligibility.

How Much Can You Get?

You choose one of two cash options — they are alternatives, not additions:

• Reimbursement of qualifying documented ordinary losses up to $2,500, together with reimbursement of qualifying documented extraordinary losses up to $10,000; or
• An alternative cash payment of $100, which requires no loss documentation.

Both options are subject to pro rata reduction or increase depending on the total volume of claims submitted, so the final figure can land above or below the stated amount once the administrator has counted valid claims against the fund.

Separately from the cash election, every settlement class member may also file a claim for two years of identity theft protection services. That benefit does not replace the cash option you choose.

What Proof Do You Need?

Filing requires the Claimant ID and PIN printed on the notice you received. That is an administrator-issued credential, so this settlement counts as requiring proof even if you take the $100 alternative cash payment, which itself needs no receipts.

If you claim documented losses instead, you also need records substantiating the ordinary or extraordinary losses you are claiming. Ordinary losses are the routine out-of-pocket costs of dealing with a breach; extraordinary losses are the larger, documented harms such as identity theft, and they carry the higher $10,000 ceiling.

If you no longer have your notice, use the contact page on the official settlement website to reach the Settlement Administrator.