Ernst & Young, Bank of America $2.5M MOVEit Data Breach Settlement

Current and former Bank of America customers who received notice from Ernst & Young that their personally identifying information was potentially compromised in the 2023 MOVEit data breach, may be eligible to submit a claim for up to $10,000 from a class action settlement. The incident impacted over 198,667 individuals.

Ernst & Young LLP (EY) and Bank of America Corp. have agreed to pay $2.5 million to settle a class action lawsuit for alleged negligent data security practices. The plaintiff claimed vulnerability in the MOVEit Transfer software, led to unauthorized access to personally identifying information (PII) provided by Bank of America to EY between May 27 and May 31, 2023.

Who can file a claim for a data breach payout?

Class members are individuals residing in the United States whose PII was included in files affected by the May 2023 MOVEit data breach, as it relates to services provided by EY to Bank of America.

How much are settlement payments?

Class members have the following benefit options:

• Ordinary losses: Class members can claim up to $2,500 for documented out-of-pocket expenses such as bank fees, phone charges, postage, or gas for local travel and fees for credit monitoring or identity theft insurance purchased after May 31, 2023.
• Lost time: Class members can claim up to four hours at $25 per hour for time spent dealing with the data breach, a maximum of $100. This is included in the $2,500 ordinary losses cap.
• Extraordinary losses: Class members can claim up to $10,000 for documented, unreimbursed monetary losses that occurred between May 31, 2023 and Oct. 8, 2026. This includes professional fees or credit repair costs and monetary losses due to fraud or identity theft directly related to the breach.
• Alternative cash payment: Class members that do not submit an ordinary losses, lost time or extraordinary losses claim can submit to receive one-time pro rata cash payment estimated at $100. The final payment amount will be determined by the total number of claims filed.
• Credit monitoring: All class members can elect to receive two years of three-bureau real-time credit monitoring and identity theft protection. Services also include dark web monitoring, up to $1 million in identity theft insurance and access to fraud resolution and identity theft restoration agents.

How to claim a class action rebate

To claim a settlement payment, class members can file a claim online or print the PDF claim form to complete and mail to the settlement administrator.

Settlement administrator's mailing address: EY and BOA Settlement c/o RG/2 Claims Administration P.O. Box 59479 Philadelphia, PA 19102-9479

The claim deadline is Oct. 8, 2026.

Required proof and claim information

• The claimant ID and pin from the settlement notice are required to submit a claim online. The claimant ID is required to submit a claim by mail.
• Ordinary and extraordinary losses claims require supporting documentation. This may include receipts, invoices, bank or credit card statements showing unreimbursed fees or fraudulent charges, invoices for professional services, police report and other proof of identity theft or fraud.

Payout options

• PayPal
• Venmo
• Paper check mailed to the address provided

Settlement fund breakdown

The $2,500,000 settlement fund will include:

• Settlement administration costs: At least $150,000
• Attorneys' fees: Up to $833,333 plus reasonable expenses
• Service awards to class representatives: Up to $2,500
• Credit monitoring: Total determined by the number of claims filed
• Payments to approved claimants: Remaining settlement funds

Important dates

• Deadline to opt out: Sept. 8, 2026.
• Deadline to file a claim: Oct. 8, 2026
• Final approval hearing: Oct. 15, 2026

When is the MOVEit Security Incident Settlement payout date?

Payments and credit monitoring information will be issued to approved claimants after the court grants final approval of the settlement.

Why was there a class action settlement?

The class action lawsuit was filed after cybercriminals exploited a vulnerability in the MOVEit Transfer software used by Ernst & Young, resulting in unauthorized access to PII provided by Bank of America. Plaintiffs alleged that EY and Bank of America failed to adequately protect this data.

EY and Bank of America deny the allegations, however agreed to settle to avoid the expense and risk of further litigation and a possible trial.

Sources

1. Official class notice
2. Settlement website
3. Claim form
4. Settlement agreement