Bank of America and Ernst & Young (EY) have agreed to a $2.5 million settlement to resolve a class-action lawsuit stemming from a 2023 data breach involving the MOVEit file transfer service. The agreement addresses allegations that the companies failed to adequately protect consumers' personal information following the exploitation of a vulnerability in MOVEit Transfer.
The security incident took place between May 27 and May 31, 2023. EY utilized the third-party software to handle specific Bank of America data containing personally identifiable information belonging to certain bank customers.
Both Ernst & Young and Bank of America have denied any allegations of wrongdoing.
Settlement Terms and Relief Options
The $2.5 million settlement fund will be used to cover valid claims, administrative and notice expenses, attorneys' fees, and other approved costs. Individuals whose personal information was contained in the files affected by the incident are potentially eligible to participate.
Eligible class members can select one of two forms of monetary relief:
- Reimbursement for documented ordinary losses of up to $2,500 and documented extraordinary losses of up to $10,000.
- An alternative cash payment of $100.
Depending on the total number of valid claims submitted, payments may be subject to pro rata adjustments. Additionally, class members who submit a valid claim can receive two years of identity theft protection services.
Key Deadlines and Hearing Schedule
Class members must submit their claims by October 8, 2026. The final deadline to object to the terms of the settlement or to be excluded from it is September 8, 2026. A final approval hearing for the settlement is scheduled for October 15, 2026.
