People who received notice from Ernst & Young that their personal information was exposed in the 2023 MOVEit breach of Bank of America customer data may qualify to claim a flat $100 or reimbursement of documented losses from the EY and Bank of America class action settlement. Claims close October 8, 2026.
Current Status
Claims are open. The deadline to file is October 8, 2026, online or postmarked. The deadlines to exclude yourself or object both passed on September 8, 2026.
The Final Approval Hearing is scheduled for October 15, 2026 at 1:00 p.m. in Courtroom 17 of the federal courthouse at 1 Courthouse Way in Boston, before Judge Allison D. Burroughs. No final approval order has been entered and no payment date has been announced.
If you received a notice from Ernst & Young about the 2023 MOVEit incident, filing a Claim Form is the only way to get money from this settlement.
What Changed Recently?
The Court preliminarily approved a settlement under which Ernst & Young LLP and Bank of America Corporation will pay $2,500,000 into a settlement fund, and the administrator began mailing notices carrying a Claimant ID and PIN. The fund pays valid claims along with notice and administration costs, a service award to the class representative, and Class Counsel's attorneys' fees and expenses.
One detail matters for anyone tracking the wider MOVEit litigation: this settlement resolves the claims against EY and Bank of America only. Claims against Progress Software Corporation, which licensed the MOVEit Transfer software, have not been resolved, and that litigation continues.
Both defendants deny any allegation of wrongdoing and deny that the plaintiff would prevail or be entitled to relief if the case were litigated. No court has found either company liable.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Who Qualifies?
You are a settlement class member if you are a living person in the United States whose personally identifying information was included in the files affected by the MOVEit Security Incident — specifically, Bank of America customer data that Bank of America had provided to Ernst & Young.
The settlement class excludes the defendants, any entity in which they have a controlling interest, and their officers, directors, legal representatives, successors, subsidiaries and assigns; any judge, justice or judicial officer presiding over the litigation, along with their immediate families and judicial staff; and anyone who timely and validly opted out.
In practice, the people in this class are Bank of America customers who received a notice letter from EY. If you never received a notice but believe your data was involved, the Settlement Administrator is the party that determines eligibility.
How Much Can You Get?
You choose one of two cash options — they are alternatives, not additions:
- Reimbursement of qualifying documented ordinary losses up to $2,500, together with reimbursement of qualifying documented extraordinary losses up to $10,000; or
- An alternative cash payment of $100, which requires no loss documentation.
Both options are subject to pro rata reduction or increase depending on the total volume of claims submitted, so the final figure can land above or below the stated amount once the administrator has counted valid claims against the fund.
Separately from the cash election, every settlement class member may also file a claim for two years of identity theft protection services. That benefit does not replace the cash option you choose.
What Proof Do You Need?
Filing requires the Claimant ID and PIN printed on the notice you received. That is an administrator-issued credential, so this settlement counts as requiring proof even if you take the $100 alternative cash payment, which itself needs no receipts.
If you claim documented losses instead, you also need records substantiating the ordinary or extraordinary losses you are claiming. Ordinary losses are the routine out-of-pocket costs of dealing with a breach; extraordinary losses are the larger, documented harms such as identity theft, and they carry the higher $10,000 ceiling.
If you no longer have your notice, use the contact page on the official settlement website to reach the Settlement Administrator.
How to File a Claim
Claims are filed at the official settlement website, MOVEitSettlementEYBOA.com. You can submit online using your Claimant ID and PIN, or download the paper Claim Form from that site and mail it to the Settlement Administrator at the address printed on the form.
Either way, the claim must be submitted online or postmarked by October 8, 2026.
The settlement notice carries a practical warning about mailing close to the deadline. Because of changes to USPS postmark dating that took effect December 24, 2025, a Claim Form mailed near the deadline may receive a postmark reflecting when it reached an automated processing facility rather than when USPS first received it — which can be several days later, depending on how far you are from that facility, and can make an otherwise timely claim late. If you are filing near the deadline, file online instead, or allow extra mailing time.
Key Deadlines
- Exclusion (opt-out) deadline: September 8, 2026 (passed)
- Objection deadline: September 8, 2026 (passed)
- Claim deadline: October 8, 2026
- Final Approval Hearing: October 15, 2026 at 1:00 p.m.
If you do nothing, you receive no payment and remain bound by the settlement's terms, including the release of the claims it resolves against EY and Bank of America.
What Happens Next?
At the Final Approval Hearing the Court will consider whether the settlement is fair, reasonable and adequate, along with Class Counsel's application for attorneys' fees and expenses and the proposed service award to the class representative. The Court will consider any objections and may hear from people who asked to speak.
A hearing being held is not the same as final approval being granted, and final approval does not by itself mean checks have been mailed. The Court may also reschedule the hearing without further notice, so check the official settlement website for updates.
The litigation against Progress Software continues regardless of what happens with this settlement.
Frequently Asked Questions
Who qualifies for the EY and Bank of America MOVEit settlement?
You are a settlement class member if you are a living person in the United States whose personally identifying information was included in the files affected by the MOVEit Security Incident — Bank of America customer data that Bank of America had provided to Ernst & Young. Defendants, their officers and affiliates, the judges presiding over the case and their immediate families and staff, and anyone who timely opts out are excluded.
How much can I claim from the EY MOVEit settlement?
You choose one of two options: reimbursement of documented ordinary losses up to $2,500 together with documented extraordinary losses up to $10,000; or a flat alternative cash payment of $100. Both are subject to pro rata reduction or increase depending on how many claims are submitted. Separately, every class member may also claim two years of identity theft protection services.
Do I need a Claimant ID to file?
Yes. Claim Forms are submitted online using the Claimant ID and PIN printed on the notice you received, or on a paper Claim Form mailed to the Settlement Administrator. Because filing is gated on an administrator-issued identifier, this settlement counts as requiring proof even if you choose the $100 alternative cash payment that needs no receipts.
Is Progress Software part of this settlement?
No. This settlement resolves claims only against Ernst & Young LLP and Bank of America Corporation. Claims against Progress Software Corporation, which licensed the MOVEit Transfer software, have not been resolved and that litigation continues.
Is this the same as the 2026 Ernst & Young data breach?
No. This settlement concerns the 2023 MOVEit Security Incident, which involved a vulnerability in the MOVEit Transfer file transfer software EY used to handle certain Bank of America data. A separate proposed class action filed in 2026 concerns a different incident involving unauthorized access to a third-party IT platform EY used for tax work. The two matters involve different incidents, different years and different data.
What happened in the MOVEit Security Incident?
Between May 27 and May 31, 2023, cybercriminals gained unauthorized access to the MOVEit file transfer software used by many organizations, including Ernst & Young, resulting in potential access to personally identifying information that Bank of America had provided to EY. The lawsuit asserts claims for alleged negligent data security practices. Defendants deny the allegations.
Other MOVEit Cases on OCA
The 2023 MOVEit incident produced a long tail of separate settlements, each covering the customers of a different organization that used the software. OCA also tracks the $2.15M GRIPA MOVEit settlement, the Union Bank and Trust MOVEit settlement and the Cadence Bank MOVEit settlement. Separately, and not part of this case, EY faces a 2026 proposed class action over a different breach involving a third-party IT platform it used for tax work. For the full list, see the data breach settlement tracker.
Sources
- Official settlement website — EY and BOA MOVEit Settlement
- Long Form Notice and Claim Form
- Court Documents
