Ernst & Young and Bank of America agree to $2.5 million MOVEit settlement

Ernst & Young and Bank of America agreed to establish a $2.5 million settlement fund over allegations that they failed to protect customer information after a MOVEit data breach. The incident occurred between May 27 and May 31, 2023. A vulnerability in MOVEit Transfer was exploited during the incident. EY used the third-party software to handle certain Bank of America data containing customers' personally identifiable information. The fund will cover valid claims, administrative and notice expenses, attorneys' fees, and other approved costs. Class members can seek reimbursement for documented ordinary losses of up to $2,500. Class members can seek reimbursement for documented extraordinary losses of up to $10,000. Class members can instead choose a $100 cash payment. Payments may be reduced on a pro rata basis based on the number of valid claims. Valid claimants can receive two years of identity theft protection services. Claims must be filed by October 8, 2026. The deadline to exclude oneself from the settlement or object to its terms is September 8, 2026. A final approval hearing is scheduled for October 15, 2026. Ernst & Young and Bank of America deny wrongdoing.