Ernst & Young & Bank of America MOVEit Settlement, Check If You Qualify — Morris v. Progress Software Corporation, No. 1:24-cv-11807

if you got a notice from Ernst & Young saying your info was caught up in the 2023 MOVEit breach — yes, you’re likely included. There’s a $2.5 million settlement fund, a flat $100 cash option or documented-loss reimbursement up to $10,000, and two years of free identity theft protection. The deadline to file is October 8, 2026.

Ernst & Young & Bank of America MOVEit Settlement — Key Facts

Field	Detail
Settlement Amount	$2,500,000
Claim Deadline	October 8, 2026
Who Qualifies	Living individuals in the U.S. whose personal information was in files exchanged between Bank of America and Ernst & Young, affected by the May 27–31, 2023 MOVEit Security Incident
Estimated Payout	Choice of (1) documented ordinary losses up to $2,500 and extraordinary losses up to $10,000, or (2) a flat $100 cash payment — both subject to pro rata adjustment. Everyone can also claim 2 years of identity theft protection
Proof Required (Yes/No)	Yes, for the documented-loss option only. Not required for the $100 flat payment or the identity theft protection
Settlement Status	Preliminarily approved April 29, 2026; final approval hearing pending
Court & Case Number	U.S. District Court, District of Massachusetts — No. 1:24-cv-11807-ADB (part of MDL No. 23-md-3083-ADB-PGL)
Law Alleged	Negligent data security practices
Administrator	RG/2 Claims Administration LLC
Official Claim Site	MOVEitSettlementEYBOA.com
Last Updated	August 21, 2026

Who Are Ernst & Young and Bank of America, and Why Are They Being Sued for This?

Ernst & Young handled tax-related work for Bank of America customers, and used MOVEit Transfer — a file-sharing tool made by Progress Software — to move that data around. That’s the whole chain: BOA’s customer data went to EY, EY moved it through MOVEit, and MOVEit had a hole in it. Neither company built the software. Both chose to run sensitive customer files through it anyway.

What Happened to Bank of America Customers Between May 27 and May 31, 2023?

Cybercriminals exploited a vulnerability in MOVEit Transfer during a five-day window in late May 2023, gaining unauthorized access to files that included personally identifying information Bank of America had provided to Ernst & Young. The lawsuit — now folded into the massive In re: MOVEit Customer Data Security Breach Litigation MDL in Boston — accuses both companies of negligent data security practices for not catching or preventing it.

This isn’t the first MOVEit-related settlement to hit this exact dollar figure. The Cadence Bank $5.25M MOVEit Data Breach Settlement resolved a nearly identical fact pattern — a bank’s vendor caught up in the same 2023 breach — and there’s a real chance your information showed up in more than one of these.

EY and Bank of America deny any wrongdoing. That’s standard in a settlement like this — it isn’t an admission the case was baseless.

Who Qualifies for the Ernst & Young MOVEit Settlement?

Here’s exactly how to know if this case includes you.

• People who got a notice from Ernst & Young about the 2023 MOVEit incident
• Anyone whose PII was in files Bank of America sent to Ernst & Young during the breach window
• Current or former BOA customers whose data passed through EY’s systems for tax-related services
• Living U.S. residents only — the estate of someone who has passed doesn’t qualify under this settlement

You do not qualify if your information was exposed through a different company’s MOVEit incident — this settlement covers only the EY–BOA data flow, not the roughly 2,700 other organizations hit by the same underlying software flaw.

Class Members Outside Massachusetts — Are You Still Covered?

This case is federal and nationwide. You don’t need to live near Boston, where the MDL is based, to be included — your inclusion depends on whether your PII was in the affected files, not your state of residence.

Not sure whether your data was involved? A free consultation with a data privacy attorney can help you check before the October 8 deadline.

How Much Can Ernst & Young & Bank of America Settlement Class Members Get? Up to $10,000 Per Person

You pick one of two paths, not both.

Path one: reimbursement for documented losses — up to $2,500 for ordinary losses (time spent, fees paid, that sort of thing) and up to $10,000 for extraordinary losses if you can show identity theft or fraud traced to this breach.

Path two: skip the paperwork and take a flat $100 cash payment instead.

Both amounts are pro rata — more valid claims filed means a smaller check for everyone, fewer claims means a bigger one. Compare that structure to the Fidelity $2.5M Data Breach Settlement — same fund size, similar tiered approach, different company entirely.

Every class member, regardless of which cash option they pick, can also claim two years of identity theft protection at no extra cost.

Documented-loss payments tied to actual fraud are generally not taxable. A flat $100 payment with no proof behind it may be treated differently by the IRS — check with a tax professional before you file.

One thing worth knowing before you decide it’s not worth the effort: claims against Progress Software, the company that actually built MOVEit, are still unresolved. This $2.5 million only closes the book on Ernst & Young and Bank of America — not the software vendor whose flaw started all of this.

How to File Your Ernst & Young MOVEit Settlement Claim

1. Find your Claimant ID and Pin on the notice you received
2. Go to the official claim portal linked from MOVEitSettlementEYBOA.com and log in
3. Choose either the documented-loss option or the flat $100 payment
4. If claiming documented losses, upload your supporting records — receipts, statements, or a police report
5. Submit online, or mail the paper form so it’s postmarked by October 8, 2026
6. Save your confirmation — and if mailing, mail early. USPS postmark-dating changes mean a claim sent close to the deadline could get stamped late through no fault of yours

Takes about 10 minutes online if you’re going with the flat payment.

If your deadline is close and you’re mailing a paper form, don’t wait until the last week — the settlement site itself warns that automated USPS processing can date-stamp your envelope days after you actually dropped it in the mail.

Should Ernst & Young / Bank of America Class Members Opt Out or Object Before September 8?

What Opting Out Actually Means

Opting out means no payment and no identity theft protection from this deal — but you keep the right to sue EY and Bank of America separately over the same breach. Most people shouldn’t opt out without talking to a lawyer first. The deadline to request exclusion is September 8, 2026.

How to Object

You can stay in the class and still object. Objections and requests to speak at the hearing must be postmarked by September 8, 2026, addressed to the Clerk, U.S. District Court for the District of Massachusetts, referencing Case No. 1:24-cv-11807-ADB.

Talk to a class action lawsuit attorney before September 8 if you’re weighing either option.

Ernst & Young & Bank of America MOVEit Settlement — Key Dates, 2026

Milestone	Date
Settlement Proposed	April 23, 2026 (motion for preliminary approval filed)
Claims Period Opens	UNVERIFIED — not separately specified beyond preliminary approval
Claim Filing Deadline	October 8, 2026
Opt-Out Deadline	September 8, 2026
Objection Deadline	September 8, 2026
Final Approval Hearing	October 15, 2026, 1:00 p.m., Courtroom 17, Boston, before Judge Allison D. Burroughs
Expected Payment Date	UNVERIFIED — payments issued after final approval and resolution of any appeals; no specific date confirmed

Ernst & Young & Bank of America MOVEit — Frequently Asked Questions, No. 1:24-cv-11807

Do I need a lawyer to file an Ernst & Young MOVEit settlement claim?

 No. The claim portal for Case No. 1:24-cv-11807-ADB is built for self-filing with your Claimant ID and Pin. A lawyer matters more if you’re considering opting out to pursue your own claim.

Is the Ernst & Young / Bank of America settlement legitimate?

 Yes. It has preliminary approval from the District of Massachusetts, and the only official site is MOVEitSettlementEYBOA.com.

When will settlement payments be sent?

 Not before the October 15, 2026 final approval hearing, and only after any appeal period passes. No specific payment date has been set.

What if I missed the claim deadline?

 Claims postmarked or submitted after October 8, 2026 aren’t guaranteed processing. If you’re near the deadline and mailing a paper form, file online instead to avoid the USPS postmark issue.

Will my settlement payment be taxable? 

Reimbursement tied to documented fraud or identity theft is generally not taxable. A flat $100 payment with no proof attached may be treated differently. Talk to a tax professional about your situation.

Does this settlement cover claims against Progress Software? 

No. This $2.5 million resolves claims only against Ernst & Young and Bank of America. The litigation against Progress Software Corporation, which owns and licenses MOVEit, is ongoing separately in the same MDL.

How many people are covered by this settlement? 

Court filings put the class at nearly 200,000 people whose data was in the files exchanged between Bank of America and Ernst & Young during the breach window.

Sources Used in This Ernst & Young / Bank of America Article

• Official Settlement Site — MOVEitSettlementEYBOA.com: https://www.moveitsettlementeyboa.com/
• Official Contact & Administrator Page: https://www.moveitsettlementeyboa.com/contact.html
• Official Claim Filing Page: https://www.moveitsettlementeyboa.com/claims_filing.html
• U.S. District Court, District of Massachusetts — MDL Case Information: https://www.mad.uscourts.gov/caseinfo/multi-district-litigation.htm
• Law360 — “BofA, EY Strike $2.5M Deal To Settle MOVEit Breach Claims,” April 23, 2026: https://www.law360.com/articles/2469223/bofa-ey-strike-2-5m-deal-to-settle-moveit-breach-claims

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the official settlement website and the U.S. District Court for the District of Massachusetts docket (No. 1:24-cv-11807-ADB), as of August 21, 2026. Last Updated: August 21, 2026.

This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.