People who received notice from Ernst & Young that their personal information was exposed in the 2023 MOVEit breach of Bank of America customer data could claim a flat $100 or reimbursement of documented losses from the $2.5 million EY and Bank of America class action settlement. Claims closed October 8, 2026, and the final approval hearing is set for October 15, 2026.
Current Status
Claims are closed. Claim Forms had to be submitted online or postmarked by October 8, 2026. The deadlines to opt out or object both passed on September 8, 2026.
The Final Approval Hearing is scheduled for October 15, 2026 at 1:00 p.m. in Courtroom 17 of the federal courthouse in Boston, before Judge Allison D. Burroughs. No final approval order has been entered and no payment date has been announced.
Filing a Claim Form by the deadline was the only way for class members to receive money from this settlement.
What Changed Recently?
The Court preliminarily approved a settlement under which Ernst & Young LLP and Bank of America Corporation will pay $2,500,000 into a settlement fund, and the administrator mailed notices carrying a Claimant ID and PIN. The claim window closed October 8, 2026. The fund pays valid claims along with notice and administration costs, a service award to the class representative, and Class Counsel's attorneys' fees and expenses.
One detail matters for anyone tracking the wider MOVEit litigation: this settlement resolves the claims against EY and Bank of America only. Claims against Progress Software Corporation, which licensed the MOVEit Transfer software, have not been resolved, and that litigation continues.
Both defendants deny any allegation of wrongdoing and deny that the plaintiff would prevail or be entitled to relief if the case were litigated. No court has found either company liable.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Who Qualifies?
The settlement class covers living people in the United States whose personally identifying information was included in the files affected by the MOVEit Security Incident — specifically, Bank of America customer data that Bank of America had provided to Ernst & Young.
The settlement class excludes the defendants, any entity in which they have a controlling interest, and their officers, directors, legal representatives, successors, subsidiaries and assigns; any judge, justice or judicial officer presiding over the litigation, along with their immediate families and judicial staff; and anyone who timely and validly opted out.
In practice, the people in this class are Bank of America customers who received a notice letter from EY. The Settlement Administrator is the party that determines eligibility.
How Much Does the Settlement Pay?
Claimants chose one of two cash options — they are alternatives, not additions:
- Reimbursement of qualifying documented ordinary losses up to $2,500, together with reimbursement of qualifying documented extraordinary losses up to $10,000; or
- An alternative cash payment of $100, which requires no loss documentation.
Both options are subject to pro rata reduction or increase depending on the total volume of claims submitted, so the final figure can land above or below the stated amount once the administrator has counted valid claims against the fund.
Separately from the cash election, settlement class members could also claim two years of identity theft protection services. That benefit did not replace the cash option chosen.
What Proof Was Required?
Filing required the Claimant ID and PIN printed on the notice class members received. That is an administrator-issued credential, so this settlement counts as requiring proof even for the $100 alternative cash payment, which itself needed no receipts.
Documented-loss claims also required records substantiating the ordinary or extraordinary losses claimed. Ordinary losses are the routine out-of-pocket costs of dealing with a breach; extraordinary losses are the larger, documented harms such as identity theft, and they carry the higher $10,000 ceiling.
How Claims Were Filed
Claims were filed through the official settlement website, MOVEitSettlementEYBOA.com, either online with the Claimant ID and PIN or on a paper Claim Form downloaded from that site and mailed to the Settlement Administrator.
Either way, the claim had to be submitted online or postmarked by October 8, 2026. That deadline has passed.
The settlement notice had warned that, because of USPS postmark-dating changes that took effect December 24, 2025, a Claim Form mailed near the deadline could receive a postmark reflecting when it reached an automated processing facility rather than when USPS first received it.
Key Deadlines
- Exclusion (opt-out) deadline: September 8, 2026 (passed)
- Objection deadline: September 8, 2026 (passed)
- Claim deadline: October 8, 2026 (passed)
- Final Approval Hearing: October 15, 2026 at 1:00 p.m.
Class members who did not opt out and did not file a valid claim receive no payment and remain bound by the settlement's terms if it is approved, including the release of the claims it resolves against EY and Bank of America.
What Happens Next?
At the Final Approval Hearing the Court will consider whether the settlement is fair, reasonable and adequate, along with Class Counsel's application for attorneys' fees and expenses and the proposed service award to the class representative. The Court will consider any objections and may hear from people who asked to speak.
A hearing being held is not the same as final approval being granted, and final approval does not by itself mean checks have been mailed. The Court may also reschedule the hearing without further notice; updates are posted on the official settlement website. No payment date has been announced.
The litigation against Progress Software continues regardless of what happens with this settlement.
Frequently Asked Questions
Who qualifies for the EY and Bank of America MOVEit settlement?
The settlement class covers living people in the United States whose personally identifying information was included in the files affected by the MOVEit Security Incident — Bank of America customer data that Bank of America had provided to Ernst & Young. Defendants, their officers and affiliates, the judges presiding over the case and their immediate families and staff, and anyone who timely opted out are excluded. The claim deadline passed on October 8, 2026.
How much does the EY MOVEit settlement pay?
Claimants chose one of two options: reimbursement of documented ordinary losses up to $2,500 together with documented extraordinary losses up to $10,000; or a flat alternative cash payment of $100. Both are subject to pro rata reduction or increase depending on how many claims were submitted. Separately, class members could also claim two years of identity theft protection services. Claims closed October 8, 2026, and no payment date has been announced.
Did filing require a Claimant ID?
Yes. Claim Forms were submitted online using the Claimant ID and PIN printed on the notice class members received, or on a paper Claim Form mailed to the Settlement Administrator. Because filing was gated on an administrator-issued identifier, this settlement counts as requiring proof even for the $100 alternative cash payment, which needed no receipts.
What was the deadline to file an EY MOVEit claim?
Claim Forms had to be submitted online or postmarked by October 8, 2026, and that deadline has passed. The deadline to opt out or object was September 8, 2026. The Final Approval Hearing is set for October 15, 2026 at 1:00 p.m. in Courtroom 17 of the federal courthouse in Boston before Judge Allison D. Burroughs.
Is Progress Software part of this settlement?
No. This settlement resolves claims only against Ernst & Young LLP and Bank of America Corporation. Claims against Progress Software Corporation, which licensed the MOVEit Transfer software, have not been resolved and that litigation continues.
Is this the same as the 2026 Ernst & Young data breach?
No. This settlement concerns the 2023 MOVEit Security Incident, which involved a vulnerability in the MOVEit Transfer file transfer software EY used to handle certain Bank of America data. A separate proposed class action filed in 2026 concerns a different incident involving unauthorized access to a third-party IT platform EY used for tax work. The two matters involve different incidents, different years and different data.
What happened in the MOVEit Security Incident?
Between May 27 and May 31, 2023, cybercriminals gained unauthorized access to the MOVEit file transfer software used by many organizations, including Ernst & Young, resulting in potential access to personally identifying information that Bank of America had provided to EY. The lawsuit asserts claims for alleged negligent data security practices. Defendants deny the allegations.
Other MOVEit Cases on OCA
The 2023 MOVEit incident produced a long tail of separate settlements, each covering the customers of a different organization that used the software. OCA also tracks the $2.15M GRIPA MOVEit settlement, the Union Bank and Trust MOVEit settlement and the Cadence Bank MOVEit settlement. Separately, and not part of this case, EY faces a 2026 proposed class action over a different breach involving a third-party IT platform it used for tax work. For the full list, see the data breach settlement tracker.
Sources
- Official settlement website — EY and BOA MOVEit Settlement
- Long Form Notice and Claim Form
- Court Documents
