Bank of America Data Breach Settlement: $17.5 Million for the 2023 Infosys McCamish Breach
Settled — Claims Period Closed
Claim deadline was December 1, 2025 · as of Oct 16, 2026
A third-party vendor breach exposed data of 6.5 million people — the $17.5M settlement closed claims in December 2025 with payouts expected in 2026.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
Can I Still File?
The claim deadline, what the settlement pays and where to file — plus other settlements still taking claims.
No. The claim deadline was December 1, 2025.
Other settlements with open claim windows
- SitusAMC Data Breach$5.3M · claim by November 6, 2026
- Kelly Benefits Data Breach$5 million · claim by December 28, 2026
- Wellstar MyChart Lawsuit$4.25M · claim by November 10, 2026
We are not a claims administrator and not affiliated with any settlement. File only at the official settlement website — filing is always free.
What the Lawsuit Alleges
Between October 29 and November 2, 2023, LockBit ransomware operators attacked Infosys McCamish Systems (IMS), a third-party benefits-administration vendor used by Bank of America and other institutions, stealing sensitive personal data. IMS notified BofA on November 24, 2023, and BofA sent breach notices on February 6, 2024. About 6.5 million people were ultimately affected, with exposure of Social Security numbers, financial account details, and medical information. The class action (McNally v. Infosys McCamish Systems LLC) alleged IMS failed to maintain adequate security. Bank of America itself was not a defendant — the claims ran against the breached vendor.
Case details
U.S. District Court, Northern District of Georgia — McNally v. Infosys McCamish Systems LLC, Case No. 1:24-cv-00995-JPB. Consolidated complaint Nov 2024; preliminary approval July 16, 2025; final approval December 18, 2025.
Current Status
Who Is Affected & Can You Join?
Individuals who received a breach notice confirming their information was compromised in the October–November 2023 Infosys McCamish incident — including BofA deferred-compensation plan participants and customers of other institutions that used IMS. Over 3.7 million received mailed notices. The December 1, 2025 deadline has passed.
Is There a Payout?
How cases like this one end
Our copy of the federal courts’ own case database covers 129,730 other contract casesclosed in U.S. federal district courts between 2015 and 2026, 6% of them filed as class actions:
- 30.7% ended in a settlement recorded by the court. Another 20.2% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 30.7% and 50.9%.
- 7.5% were decided on a motion before any trial.
- 1 in 72 reached a trial (1.4%), after a median of 29.3 months.
- Median time from filing to the end of the case: 7.6 months.
- Only 7,691 of them (5.9%) record a money award at all; the median of those is $407,000.
These are base rates for this type of case (federal other contract cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Case Timeline
LockBit Ransomware Attack (Oct–Nov 2023)
LockBit operators breached Infosys McCamish Systems, exfiltrating sensitive data of millions of customers of IMS's financial-institution clients, including Bank of America.
Notification & Scope Expansion (Nov 2023–Feb 2024)
IMS notified BofA on Nov 24, 2023; BofA sent breach notices on Feb 6, 2024. By April 2024, ~6.5 million individuals were determined to be affected.
Class Actions Consolidated (2024)
Multiple suits were consolidated in the Northern District of Georgia as McNally v. Infosys McCamish Systems LLC; a consolidated complaint was filed in November 2024.
Settlement Approval (Jul–Dec 2025)
The parties reached a $17.5M settlement; preliminary approval July 16, 2025 and final approval December 18, 2025. The claim deadline was December 1, 2025.
Distribution Phase (2026)
The settlement became effective and Infosys has paid the settlement amount into the fund; payments to valid claimants follow once the administrator completes claim processing (no date announced); the residual cash payment is estimated around $30, with more for documented-loss claims.
Court Documents
Read the key filings yourself. We host copies of the public court record, free to read and share.
Case: McNally v. InfoSys McCamish Systems, LLC, No. 1:24-cv-00995 (N.D. Ga.)
- Class Action ComplaintMar 6, 2024 · ECF No. 1 · 40 pages · PDF, 370 KB
- Motion for Final Approval of SettlementDec 4, 2025 · ECF No. 73 · 5 pages · PDF, 226 KB
- Final Approval OrderDec 18, 2025 · ECF No. 81 · 12 pages · PDF, 130 KB
A complaint states one side's allegations; only the court's orders decide anything. Copies of federal court records (PACER) via CourtListener, Free Law Project. Not legal advice.
Scam & Misinformation Warnings
Whenever a brand lawsuit goes viral, scam sites and bad actors follow. Watch for these red flags:
BofA Impersonation Emails
Scammers send emails appearing to be from Bank of America offering a 'data breach compensation payment' and linking to fake sites. BofA was not the defendant, the administrator is for McNally v. Infosys McCamish, and the deadline has passed.
Fake 'Credit Monitoring Activation' Phishing
Because credit monitoring was a settlement benefit, fraudsters send phishing emails to 'activate' it and harvest credentials. Legitimate activation comes from the administrator via the official settlement site.
Broader 'BofA Settlement' Confusion
Multiple unrelated Bank of America settlements exist (overdraft/junk fees). There is also a second, separate data breach settlement: Ernst & Young and Bank of America have proposed a settlement of claims over BofA customer data exposed in the 2023 MOVEit incident (Morris v. Progress Software Corporation, D. Mass.). Its claim deadline was October 8, 2026, and the court has yet to decide on final approval; a hearing was scheduled for October 15, 2026. Always verify the specific settlement through official court dockets before sharing personal information.
Frequently Asked Questions
Short answers to the questions people ask most about this case.
Was Bank of America hacked directly?
No. BofA's own systems were not breached. The “bankofamerica breach” reported in early 2024 was a vendor incident. The attack targeted Infosys McCamish Systems (IMS), a third-party vendor that administered products for BofA and others. IMS's breach exposed data BofA had shared with it.
Can I still file a claim?
No. The claim deadline was December 1, 2025 and is permanently closed. If you didn't submit a valid claim by then, you're not eligible for monetary benefits.
How much will claimants receive?
The estimated pro-rata residual cash payment is about $30, depending on the number of valid claims. Documented-loss claimants can receive up to $6,000, and all timely claimants get two years of credit monitoring.
When will payments be distributed?
Final approval was December 18, 2025. Infosys reports that the settlement amount has since been paid and the settlement has become effective. The Bank of America settlement payout date has not been announced — the administrator (Kroll) issues payments to approved claimants after it completes claim processing.
What data was exposed?
Highly sensitive information including Social Security numbers, dates of birth, names, addresses, financial account numbers, and medical information — varying by which institution's data IMS was processing.
Is this only for Bank of America customers?
No. It covers everyone who received an Infosys McCamish breach notice for the 2023 incident, regardless of institution. IMS served multiple clients; ~6.5 million people were affected and over 3.7 million received mailed notices.
Did Infosys or Bank of America admit wrongdoing?
No. Infosys McCamish denied liability; Bank of America was not a defendant in the McNally case and made no admissions. The settlement also resolves seven related class action lawsuits that were filed against McCamish’s customers. The settlement was a negotiated resolution.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- USAA LawsuitUSAA Lawsuit 2026: Total Loss Underpayment Claims
- TransUnion SettlementTransUnion Settlement 2025: $23M FCRA Payout
- Credit One Bank LawsuitCredit One Bank TCPA Lawsuit 2026: Robocall Claims
- Affirm BNPL LawsuitAffirm Class Action Lawsuit 2026: BNPL Deception
- Dog Bite Settlement Calculator$64K average payout — strict-liability vs one-bite states
- Truck Accident Settlement CalculatorCommercial policies mean larger settlements — estimate yours
- Motorcycle Accident CalculatorPayouts run 2–3× car accidents — real 2026 data