Ernst & Young / Bank of America MOVEit Data Breach Settlement

Ernst & Young LLP and Bank of America Corporation settled allegations that a vulnerability in the third-party MOVEit Transfer file-transfer software led to a 2023 breach that may have exposed personal information Bank of America provided to Ernst & Young. Ernst & Young LLP and Bank of America Corporation denies any wrongdoing and the court made no finding of liability.

A settlement over the 2023 MOVEit data breach, which exploited a vulnerability in the third-party MOVEit Transfer software and may have exposed personal information that Bank of America provided to Ernst & Young. People notified by Ernst & Young can claim cash or reimbursement of documented losses, plus identity-theft protection.

Total settlement

$2,500,000

Claim deadline

Oct 8, 2026

Who is eligible

Living U.S. residents who were notified by Ernst & Young that their personal information was in the files affected by the MOVEit breach.

How you get paid

Reimbursement of documented losses up to $10,000, or an alternative cash payment of $100, from a $2,500,000 settlement fund. All class members may also claim two years of identity-theft protection services.

Proof required

Documented-loss claims require reasonable documentation; the $100 alternative cash payment and identity protection require no proof.

This information is not a substitute for legal advice.