$2.5M Settlement Resolves Claims Against Ernst & Young, Bank of America Over May 2023 MOVEit Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Ernst & Young LLP and Bank of America have agreed to a $2,500,000 settlement to partially resolve a class action lawsuit over the May 2023 data breach affecting MOVEit, a file transfer software Ernst & Young used for handling sensitive information pertaining to Bank of America’s customers.

Get class action lawsuit and class action settlement news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter.

The $2.5 million class action settlement received preliminary approval from the court on April 29, 2026. The deal covers all living individuals in the United States whose personally identifiable information was included in the files exchanged by Ernst & Young and Bank of America that were affected by the May 2023 MOVEit data breach.

Court documents estimate that 198,667 people are covered by the settlement.

The court-approved website for the Ernst & Young and Bank of America MOVEit class action settlement can be found at MOVEitSettlementEYBOA.com.

Settlement class members who file a timely, valid claim form can receive up to $2,500 for documented “ordinary” losses incurred between May 31, 2023 and October 8, 2026 because of the MOVEit data breach. This benefit covers costs for credit reports, credit monitoring, identity theft insurance products, bank fees, long-distance phone charges, phone and data charges if charged based on the amount of time/data used, postage, gasoline and more.

As part of this benefit, class members can claim reimbursement for up to four hours of lost time spent responding to the data breach at a rate of $25 per hour, subject to the $2,500 cap on ordinary-loss payments.  

Further, class members can submit a claim form to receive up to $10,000 for documented “extraordinary” losses incurred between May 31, 2023 and October 8, 2026 stemming from the breach. This benefit covers proven monetary losses and professional fees, including attorneys’ fees, accountants’ fees, and fees for credit repair services that are not already covered by another settlement benefit. 

Class members must submit proof, such as bank statements or receipts, to receive an ordinary- or extraordinary-loss payment.  

In lieu of any of the foregoing cash payments, class members can submit a claim form to receive a $100 cash payment, with no proof required.

The final amount of each class member’s cash payout may be adjusted pro rata (i.e., equally) depending on the number of valid claims filed, among other factors.

Finally, all class members can elect on their claim form to receive two years of credit monitoring and identity theft protection services, which include dark web monitoring and identity theft insurance.

To submit a MOVEit settlement claim form online, class members can head to this page and enter the claimant ID and PIN found on their copy of the settlement notice. Alternatively, class members can download a PDF claim form to print, fill out and return by mail to the settlement administrator.

All settlement claim forms must be submitted online or postmarked by October 8, 2026.

The court will determine whether to grant the MOVEit settlement final approval following a hearing on October 15, 2026. Compensation will begin to be distributed to class members only after final approval has been granted and any appeals have been resolved.

While the class action settlement resolved claims against both Ernst & Young and Bank of America, claims against Progress Software Corporation, the licensor of the MOVEit software, have not been resolved, and litigation will continue against Progress.

The class action lawsuit alleged that sensitive personal information provided by Bank of America to Ernst & Young may have been compromised by a data breach impacting the MOVEit file transfer software between May 27 and May 31, 2023.

Per court documents, private information that may have been impacted in the MOVEit breach included first and last names, addresses, dates of birth, financial account information, debit or credit card numbers, usernames, PINs, passwords, personal health information, Social Security numbers and other unique government-issued ID numbers. 

Head to ClassAction.org’s settlements page for a complete list of data breach settlements.