Ernst & Young / Bank of America MOVEit Data Breach Settlement

Who Was Eligible?

Who the settlement covered:

• The notification letter is the test, and it is the only test we can stand behind. If Ernst & Young or Bank of America wrote to you about MOVEit, you are in the notified population this settlement concerns. If neither did, you are not — however badly the 2023 MOVEit hack treated you elsewhere.
• That distinction is worth labouring because MOVEit reached hundreds of organizations. Progress Software made the file transfer tool; the companies using it each notified their own customers and each faced their own lawsuits.
• Two other MOVEit settlements sit on this site and both have closed: the GRIPA one, which shut on 3 September 2026, and Union Bank and Trust, which shut on 21 July 2026. Neither overlaps with this one.
• Ernst & Young's role here was as a service provider. Bank of America customers whose data EY held are the reason both names appear on the same settlement.
• What we cannot tell you is the formal class definition, because no court-approved notice for this settlement could be located. The usual shape for a data breach class is everyone whose information appeared in a specified file and who was sent notice, but that is a general pattern rather than a statement about this case.
• The letter names the administrator. That is where the real class definition, the real deadline and the real claim form live.

How Much Did It Pay?

A figure of $12,500 circulates for this settlement and for several other MOVEit ones. It is almost certainly two separate caps added together.

Data breach settlements of this shape usually offer two distinct routes. Ordinary out-of-pocket costs — credit monitoring you bought, fees, postage, time spent sorting out fraud — capped at around $2,500 with receipts. Then a separate extraordinary loss route for people who suffered actual identity theft traceable to the breach, capped at around $10,000 and requiring much stronger evidence.

Add the two ceilings and you get $12,500, which is how the number appears to have been born. Nobody is handed $12,500. The two tiers serve different situations, the extraordinary route is hard to prove, and almost everyone who claims does so under the smaller one.

We are describing the general pattern here, not this settlement's actual terms, because no court-approved notice could be found. The $2.5 million fund figure and the $10,000 cap both come from secondary sources.

What is worth understanding regardless is the arithmetic of a small fund. $2.5 million across a notified population of any size, after fees and administration, does not leave large individual payments. If the population runs to tens of thousands, the realistic per-person outcome is tens of dollars, not thousands, unless you are claiming documented losses.

How this claim was filed

This settlement is closed, so the steps below are kept for reference only — they no longer lead anywhere you can file.

• Find the letter first. Everything else depends on it. A data breach notice names the settlement administrator, carries your Notice ID or claim number, and states the actual deadline. Without it you are guessing, and so are we.
• Search your email for MOVEit, for Ernst & Young and for Bank of America, and check post from 2023 onward. These notices are easy to mistake for marketing and easy to bin.
• Do not file through an aggregator. Some settlements void claims submitted by third parties outright, and even where they do not, the administrator named in your letter is the only route that is certainly valid. Any site charging you a fee for this is worth walking away from.
• If you cannot find the letter, contact Ernst & Young or Bank of America directly and ask whether you were included in the MOVEit notification and which administrator is handling it. They hold the list.
• Gather documents before the deadline rather than after. Receipts for credit monitoring, bank or card statements showing fraud, correspondence with credit bureaus, notes of hours lost. The documented-loss route is the one that pays properly and it is evidence-hungry.
• The date reported for this settlement is 8 October 2026. We could not confirm it against an administrator or a court order, so if your letter says something different, your letter is right.

Frequently Asked Questions