The Ernst & Young / Bank of America MOVEit Settlement: Claims Open Until October 8
Three years after the May 2023 MOVEit attack rippled through hundreds of companies, one of its class actions is paying out. If Bank of America customer data of yours moved through Ernst & Young's file transfers, you are among 198,667 people who can file — and the honest math favors doing it.
Revisado Editorialmente — Contenido revisado en cuanto a exactitud utilizando investigación legal publicada, datos gubernamentales y registros judiciales verificados. Vea nuestra metodología
Reviewed by Leonard Goldberg, Editor · Last updated
What the Case Is About
In May 2023, attackers exploited MOVEit, a file transfer product used across corporate America — one of the largest data events of the decade, touching hundreds of organizations. This settlement resolves one specific slice: claims against Ernst & Young LLP, which used MOVEit to exchange files containing Bank of America customer information, and against Bank of America itself. The class action alleged the companies failed to protect that data. EY and Bank of America agreed to a $2.5 million settlement covering an estimated 198,667 people — without admitting wrongdoing, as is standard.
Case Details
The settlement covers all living U.S. individuals whose personally identifiable information was included in the files exchanged by Ernst & Young and Bank of America that were affected by the May 2023 MOVEit breach. The final approval hearing is October 15, 2026; the claim deadline lands a week earlier. Note the scope carefully: MOVEit spawned many separate cases against many companies. This settlement pays only the EY/Bank of America class — if your MOVEit exposure came through a different organization, this is not your fund.
Status as of 24 August 2026
Who Can File
The roughly 198,667 people whose personal information sat in the EY/Bank of America file exchanges hit by the May 2023 MOVEit breach — most received notification letters back in 2023 and are identified in the administrator's records. If you received a MOVEit-related notice naming Ernst & Young or Bank of America, this is your settlement. If you moved since 2023, contact the administrator through the official site; class membership follows the 2023 records, not your current address.
The $100-or-Documentation Choice
How This Case Got Here
- 1
May 2023 — the MOVEit attack
Attackers exploit the MOVEit file transfer product used by hundreds of organizations — including Ernst & Young's exchanges of Bank of America customer data.
- 2
2023 — notifications
Affected individuals receive breach notices; litigation begins against many MOVEit-linked companies, including EY and Bank of America.
- 3
2026 — the $2.5 million settlement
EY and Bank of America agree to settle the class claims covering 198,667 people; the court grants preliminary approval and notices go out.
- 4
October 8, 2026 — claim deadline
Claims must be filed by this date at MOVEitSettlementEYBOA.com or by mail. Only filed claims receive benefits.
- 5
October 15, 2026 — final approval hearing
The court decides whether to approve the settlement. Payments follow final approval and the resolution of any appeals.
Three Things to Keep Straight
MOVEit produced dozens of look-alike settlements and years of confusion — which is exactly what impostors trade on.
Mixing up MOVEit settlements
This fund pays only people whose data was in the EY/Bank of America file exchanges. Delta Dental, government agencies, pension funds and dozens of others ran separate MOVEit cases with separate administrators. Match the defendant on your 2023 notice to the settlement you file in.
“Bank of America settlement” sites that blur the cases
Bank of America has faced more than one data incident — this MOVEit settlement is distinct from other Bank of America breach matters. A site that cannot tell you which incident it means is not a site to trust with your details.
A fee to file or “verify” your identity by phone
Filing is free at MOVEitSettlementEYBOA.com. The administrator does not cold-call for Social Security numbers or bank logins. Unsolicited calls quoting the settlement are the scam.
Common Questions
When is the deadline?
October 8, 2026 — claims filed online or postmarked by that date. The final approval hearing follows on October 15, 2026.
Should I take the $100 or claim documented losses?
With receipts for breach-related costs — especially any actual identity theft from 2023 onward — the documented route pays up to $2,500 for ordinary and $10,000 for extraordinary losses. Without documentation, the $100 flat payment plus two years of identity protection is the sensible claim, and better than most flat offers in breach settlements this size.
I banked with Bank of America in 2023. Am I automatically included?
Not automatically — the class is defined by whose data was in the specific EY/Bank of America file exchanges hit in May 2023, roughly 198,667 people who were notified at the time. The administrator can confirm membership through the official site.
What was MOVEit, and why did my data go through Ernst & Young?
MOVEit is file transfer software companies use to move large data sets securely. Ernst & Young — Bank of America's outside professional services firm — used it to exchange files containing customer information. When MOVEit was breached in May 2023, data in transit through those exchanges was exposed. Vendor chains like this are why breach notices often come from companies you never dealt with directly.
When will payments arrive?
After the October 15, 2026 final approval hearing and the resolution of any appeals — realistically 2027. From breach (May 2023) to payment, this case will have run about four years, which is typical for large multi-defendant breach litigation.
Does the settlement mean EY or Bank of America admitted fault?
No. The settlement resolves the claims without an admission of wrongdoing. The court's approval concerns fairness to the class, not a finding of liability.
How do I verify this?
Through MOVEitSettlementEYBOA.com — the court-approved settlement site — and the public docket. Figures here reflect what we could confirm as of 24 August 2026; the official notice controls where anything differs.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.