Ernst & Young / Bank of America MOVEit data breach settlement
Morris v. Progress Software Corporation et al. (Ernst & Young LLP and Bank of America Corporation MOVEit settlement)
Also known as EY; MOVEit breach; RG/2
The lawsuit said EY and Bank of America failed to protect personal data in the 2023 MOVEit incident.
- You could get
- About $100 $2,500 ordinary + $10,000 extraordinary.
Source
“an alternative cash payment of $100”
From the administrator site: Settlement website home page (official).
- Claims
- Closed Oct 8, 2026
Source
“You must complete and submit a Claim Form by October 8, 2026.”
From the administrator site: Settlement website home page (official).
- Who can file
- Bank of America data at EY in May 2023 MOVEit hack, U.S. people
Source
“You are included in the Settlement as a "Settlement Class Member" if you are a living person in the United States whose PII was included in the files affected by the Security Incident.”
From the administrator site: Settlement website home page (official).
- Where
- Anywhere in the U.S.
Source
“The Settlement Class is defined as: “all living persons in the United States whose PII was included in the files affected by the Security Incident,””
From the administrator site: Long Form Notice (official PDF).
Quick answers
How much is the Ernst & Young / Bank of America MOVEit data breach settlement payout?
About $100. $2,500 ordinary + $10,000 extraordinary.
Can I still file a claim for the Ernst & Young / Bank of America MOVEit data breach settlement?
No. Claims closed on Oct 8, 2026.
Is the Ernst & Young / Bank of America MOVEit data breach settlement legit?
The settlement administrator (the company that handles claims) is RG2 Claims Administration, and the official site is www.moveitsettlementeyboa.com. Real notices point there; if a link in a message goes anywhere else, do not use it.
The official site never asks you to pay to file.
Also ending this week
Related settlements
Confirm with the administrator before you act.
Case details
- Case
- Morris v. Progress Software Corporation et al. (Ernst & Young LLP and Bank of America Corporation MOVEit settlement)
- Court
- U.S. District Court, District of Massachusetts
- Case number
- 1:24-cv-11807-ADB
- Administrator
- RG2 Claims Administration
- Official site
- www.moveitsettlementeyboa.com
- Settlement fund
- $2,500,000
- Full payout terms
- Documented losses (up to $2,500 and $10,000) or $100Reimbursement of documented ordinary losses up to $2,500 and documented extraordinary losses up to $10,000, or an alternative cash payment of $100 (all subject to pro rata reduction or increase); plus 2 years of identity theft protection services
- Effort
- Medium, about 8 minutes
Other dates
- Opt-out (exclusion) deadline
- (passed) source document
- Objection deadline
- (passed) source document
- Final approval hearing
- (passed) source document
The court’s exact words
all living persons in the United States whose PII was included in the files affected by the Security Incident
Quoted from the official notice. Read the notice for the full definition.
Our notes: The settlement covers living people in the United States whose personal information was in the files affected by the May 2023 MOVEit security incident as it relates to data Bank of America gave to Ernst & Young. The notice says people who received notice from Ernst & Young about the incident may be covered. Claims against Progress Software, the maker of MOVEit, are not part of this settlement. Claiming online uses the Claimant ID and PIN printed on the notice; a paper form is also available. The administrator is RG2 Claims Administration, LLC. Read the official notice to see whether the class definition applies to you.
You may be included if you live in the U.S. and your personal information was in files affected by the 2023 MOVEit incident at EY.
Sources and checks (4)
- Settlement website home page (official) administrator site
- Long Form Notice (official PDF) administrator site
- Claim Form (official PDF) administrator site
- CourtListener docket: Morris v. Progress Software Corporation, 1:24-cv-11807 (D. Mass.) court record
What changedLast change Nov 6, 2026
- Payout text no longer mentions credit monitoring, since the source only states 2 years of identity theft protection services. source document
- Payout text now says ordinary and extraordinary losses can both be claimed (not either-or), and adds the 2 years of credit monitoring and identity theft protection. source document
- Corrected the maximum shown. The documented-loss limits add up: up to $2,500 for ordinary losses and up to $10,000 for extraordinary losses, claimed together, so 'Up to $10,000' was too low. The notice does not print a combined figure, so both limits are shown. source document
- The October 8, 2026 claim deadline has passed, so claims are now closed. The official home page still gives October 8, 2026 as the claim deadline and announces no extension. The final approval hearing was set for October 15, 2026; the site has not posted an outcome. The home page sentence we quoted for the Claimant ID and PIN was reworded, so the quote now points to the sentence that is on the page today; the fact is unchanged. source document
- Claim deadline detail no longer suggests asking for a hand postmark, because the settlement site does not say that; it now repeats the site's advice to allow extra time for postal processing and that online filing needs the Claimant ID and PIN. This came from the independent second check. source document
- Page created. Claims open until October 8, 2026. source document
Questions
I already filed. What now?
If your claim was filed on time and accepted, it is in the pool. The administrator pays, usually after final approval and any appeals. Contact the administrator with your claim ID if something looks wrong. Never pay anyone to check on a claim.