Fidelity Investments $2.5M Data Breach Settlement: Claims Closed July 27, 2026

The claim deadline was Monday, July 27, 2026. The settlement's own claim page now returns “The Claim Deadline has passed.” Judgment was entered on July 9, 2026. Nothing on this page is a route to money, and any site offering you a “Fidelity claim form” today is either stale or a scam.

Two things are still genuinely unknown, and we are not going to pretend otherwise. There is a docket entry dated July 30, 2026 whose text is not freely retrievable, so we cannot tell you whether anyone appealed. And no payment date has been published anywhere — not on the dates page, not in the FAQ. The agreement says payments issue “within thirty (30) days after the allocation and distribution of funds are determined by the Settlement Administrator following the Effective Date,” and that checks go void 90 days after they are cut. If you filed in time, that is your timetable: after finality, not after approval.

There is one small irony worth recording. The homepage and FAQ of fidelitydatasettlement.com still tell readers the court “still has to decide whether to approve” a settlement it approved on July 9. Only the claim form page was updated. We have now seen this on three court-authorised settlement websites in three weeks.

The search term collapses three separate incidents across four entries — the second row is the regulatory track of the first. Only the first is this settlement.

If your letter came from a life insurance company, or if the name on it was Fidelity National, this is not your case.

The consent order from the Massachusetts Securities Division is the most detailed public account of what happened, and it reads nothing like a press release.

In July 2024 the attacker opened two brokerage accounts under other people's identities — the order calls it “a type of identity theft known as 'true name fraud'.” Logged in as an authenticated customer, the threat actor reached the document image retrieval function, where the image identifier was a plain ten-digit number. Changing the number returned somebody else's document.

On August 17 came a test run of roughly a thousand requests. On August 18 and 19 roughly 23.7 million requests — most likely scripted — hit randomly generated ten-digit IDs and pulled down roughly 373,000 document images belonging to other customers.

It was not the security team that caught it. At 8:06 a.m. on August 19 a denial-of-service detector fired; only when analysts looked did they find no DDoS, but a mass download. The accounts were closed the same day. No customer money or account access was involved.

The finding that stings, in the order's own words: “At the time of the data breach, Fidelity did not reasonably enforce its technical security policies designed to restrict users… to accessing only the images in the Document Image Repository that are associated with the user's account.”

And this, which explains why some people never heard about any of it: “On or about October 9, 2024, Fidelity undertook to provide notice of the Data Breach to Massachusetts residents but failed to provide notice of the Data Breach to certain Massachusetts residents.” The order does not itemise who was missed; trade coverage of the case names beneficiaries, relatives and minors. What the order itself records is that of at least 2,768 affected Massachusetts residents, at least 2,650 were FBS customers or otherwise connected to FBS accounts. Fidelity was ordered to notify the Massachusetts residents it had missed within 30 days, to retain an independent cybersecurity consultant, to certify its revised controls within 90 days, and it was formally censured.

Notification of everyone else came on October 9, 2024 — about seven weeks after detection. That delay is one of the things the class action complained about.

The fund is $2,500,000 and it does not grow: “The Settlement Fund represents the total extent of Defendants' monetary obligations under the Settlement Agreement.”

• Documented monetary losses: up to $5,000 per class member
• Pro-rata cash payment with no documentation: expected $100, with the standard caveat “may be larger or smaller depending on the total claims filed”
• California subclass: an additional $50 under the CCPA
• Two years of CyEx credit and identity monitoring with $1,000,000 of identity-theft insurance
• Class counsel asked for up to one third of the fund plus $45,000 in costs; five class representatives asked for $2,500 each. What the court actually awarded on July 9 is not in any freely available document

Here is the number that explains everything about breach settlements. The agreement states the intended class: “It is intended that these approximately 155,000 individuals or joint accountholders shall constitute the members of the Class.” $2.5 million across 155,000 people is about $16 each, gross — before fees, service awards and administration. A $100 payment only works because most of the class never files. That is not a criticism of this deal; it is how every one of these works, and it is worth knowing before you read the next headline promising “up to $5,000.”

The class was wider than the mailing list, which is a detail worth keeping for future cases: Fidelity “determined that approximately 77,099 individuals were required to be notified,” and the settlement then added roughly 86,000 more people and joint accountholders whose account number and routing number were exposed but who no state law required anyone to tell. Receiving no letter did not mean being outside the class.

Then the judgment binds you. The opt-out deadline was June 26, 2026; you did not take it, so your claims against Fidelity arising from this incident are released whether or not you ever saw a letter. That is the part of these settlements people discover far too late, and it is the reason the deadline mattered even to someone who did not want the $100.

What is still worth doing has nothing to do with this settlement: the exposed categories included Social Security numbers, passport and driver's licence numbers, bank account and routing numbers and scanned images of active credit cards. A security freeze at all three bureaus is free, permanent and unrelated to any deadline. If you are a Massachusetts resident who thinks a document of yours was in someone else's file — a beneficiary, a spouse, a child — the consent order required Fidelity to reach you; if it never did, that is a matter for the Securities Division, not for the closed claims process.

We will update this page when a payment date appears.