Ernst & Young, Bank of America $2.5M MOVEit Data Breach Settlement

Current and former Bank of America customers who received notice from Ernst & Young that the 2023 MOVEit data breach may have compromised their personally identifying information could be eligible to submit a claim for up to $12,500 from a class action settlement. The incident impacted more than 198,667 individuals.

Ernst & Young LLP and Bank of America Corp. agreed to pay $2.5 million to settle a class action lawsuit alleging negligent data security practices. The plaintiff claimed vulnerability in the MOVEit Transfer software, led to unauthorized access to personally identifying information Bank of America provided to EY between May 27 and May 31, 2023.

Who can file a claim for a data breach payout?

Class members are individuals residing in the United States whose PII the May 2023 MOVEit data breach potentially affected as it relates to services EY provided to Bank of America.

How much are settlement payments?

Class members have the following benefit options:

• Ordinary losses: Class members can claim up to $2,500 for documented out-of-pocket expenses, such as bank fees, phone charges, postage, gas for local travel and fees for credit monitoring or identity theft insurance purchased after May 31, 2023.
• Lost time: Class members can claim up to four hours at $25 per hour ($100 maximum) for time spent dealing with the data breach. This is included in the $2,500 ordinary losses cap.

• Extraordinary losses: Class members can claim up to $10,000 for documented, unreimbursed monetary losses that occurred between May 31, 2023, and Oct. 8, 2026. This includes professional fees or credit repair costs and monetary losses due to fraud or identity theft directly related to the breach.
• Alternative cash payment: Class members who do not submit an ordinary losses, lost time or extraordinary losses claim can submit a claim to receive a one-time pro rata cash payment estimated at $100. The settlement administrator will determine the final payment amount by the total number of claims filed.
• Credit monitoring: All class members can elect to receive two years of three-bureau real-time credit monitoring and identity theft protection. Services also include dark web monitoring, up to $1 million in identity theft insurance and access to fraud resolution and identity theft restoration agents.

How to claim a class action rebate

To claim a settlement payment, class members can file a claim online or print the PDF claim form to complete and mail to the settlement administrator.

Settlement administrator's mailing address: EY and BOA Settlement, c/o RG/2 Claims Administration, P.O. Box 59479, Philadelphia, PA 19102-9479

The claim deadline is Oct. 8, 2026.

Required proof and claim information

• All class members must provide the claimant ID from the settlement notice they received. Online claimants must provide the PIN from the same notice.
• Ordinary and extraordinary losses claims require supporting documentation. This may include receipts, invoices, bank or credit card statements showing unreimbursed fees or fraudulent charges, invoices for professional services, police reports and other proof of identity theft or fraud.

Payout options

• PayPal
• Venmo
• Paper check mailed to the address provided

Settlement fund breakdown

The $2,500,000 settlement fund will include:

• Settlement administration costs: At least $150,000
• Attorneys' fees: Up to $833,333 plus reasonable expenses
• Service awards to class representatives: Up to $2,500
• Credit monitoring: Total determined by the number of claims filed
• Payments to approved claimants: Remaining settlement funds

Important dates

• Deadline to opt out: Sept. 8, 2026.
• Deadline to file a claim: Oct. 8, 2026
• Final approval hearing: Oct. 15, 2026

When is the MOVEit security incident settlement payout date?

The settlement administrator will issue payments and credit monitoring information to approved claimants after the court grants final approval of the settlement.

Why is there a class action settlement?

The class action lawsuit claimed cybercriminals exploited a vulnerability in the MOVEit Transfer software Ernst & Young used, resulting in unauthorized access to PII Bank of America provided. The plaintiffs alleged EY and Bank of America failed to adequately protect this data.

EY and Bank of America deny the allegations but agreed to settle to avoid the expense and risk of further litigation and a possible trial.

Sources

1. Class notice
2. Settlement website
3. Claim form
4. Settlement agreement