Last verified: 7 October 2026
The claim deadline is tomorrow, October 8, 2026. If you received a letter from Ernst and Young about a Bank of America data breach, you have until end of day tomorrow to file. A $100 flat payment requires nothing but the Claimant ID and PIN from that letter.
This settlement is small relative to the number of people affected: $2.5 million for nearly 200,000 class members. But the flat $100 no-proof option is real, the claim form is short, and the deadline is immediate.
Quick summary
| Settlement fund | $2,500,000 |
| Class size | Approximately 198,667 individuals |
| Claim deadline | 8 October 2026 (online or postmarked) |
| Flat cash, no proof | $100 (Claimant ID and PIN from notice required) |
| Ordinary documented losses | Up to $2,500 |
| Extraordinary documented losses | Up to $10,000 |
| Additional benefit | 2 years of credit monitoring, dark web monitoring, identity theft protection, and up to $1,000,000 identity theft insurance (all class members) |
| Opt-out and objection deadlines | September 8, 2026, passed |
| Fairness hearing | October 15, 2026 at 1:00 p.m. |
| Official site | MOVEitSettlementEYBOA.com |
| Administrator | RG/2 Claims Administration LLC, 888-295-3216 |
| Case | Morris v. Progress Software Corp., No. 1:24-cv-11807-ADB, D. Mass. |
What happened: the MOVEit breach explained
In May 2023, security researchers and ransomware group Cl0p exploited a critical zero-day vulnerability in Progress Software’s MOVEit Transfer tool, a file transfer application used by thousands of organizations worldwide.
Between May 27 and May 31, 2023, attackers moved through MOVEit installations before the vulnerability was even publicly known, stealing data from organizations that used the tool to process or transfer files. The breach ultimately affected hundreds of companies and tens of millions of people globally.
Ernst and Young was among the companies using MOVEit to process certain Bank of America customer data. When EY’s MOVEit installation was compromised, Bank of America customer personally identifiable information that EY held was exposed.
The data exposed includes names, addresses, dates of birth, Social Security numbers, financial account information, and other personally identifiable information belonging to Bank of America customers whose data was being processed by Ernst and Young.
This settlement covers the EY and Bank of America portion of that breach. EY and Bank of America both deny wrongdoing. The court has not determined that either did anything wrong.
Is this the full MOVEit settlement?
No, and this distinction matters.
This settlement covers EY and Bank of America only. It resolves claims against Ernst and Young and Bank of America arising from their use of Progress Software’s MOVEit tool.
Progress Software Corporation itself is not settling here. Claims against Progress Software, the company that made MOVEit and whose software contained the vulnerability, remain ongoing in a separate multidistrict litigation: In re: MOVEit Customer Data Security Breach Litigation, MDL No. 1:23-md-03083-ABD, also in the District of Massachusetts, also before Judge Allison D. Burroughs.
If you were affected by a different MOVEit breach at a different company, this settlement likely does not cover you. If you received a notice letter specifically from Ernst and Young about Bank of America customer data, this is the settlement for you.
Who qualifies
The settlement class is made up of Bank of America customers who received a notice letter from Ernst and Young about their personal information being exposed in the 2023 MOVEit breach.
You were sent a notice letter with a unique Claimant ID and PIN if you are a class member. That letter is your primary credential for filing.
Excluded are individuals who opt out, settled separately, officers and directors of the defendants and their family members, and judges assigned to related proceedings.
If you received a notice but are unsure whether this is the right settlement for your situation, call the administrator at 888-295-3216.
What you can claim
Option 1: flat $100 cash, no documentation
A flat cash payment of $100 for every valid class member who files.
This requires only:
- Your completed claim form
- Your Claimant ID and PIN from the notice letter
No receipts, no bank statements, no documentation of any loss. If you have the letter and the deadline has not passed, you can file this in a few minutes.
Note: all cash payments are subject to pro rata adjustment. With approximately 198,667 class members and a fund of $2.5 million, the no-proof tier will pay significantly less per person if most people file. The $100 figure is the stated payment level, not a guarantee.
Option 2: ordinary documented losses, up to $2,500
For class members who can document losses that plausibly resulted from the breach. Ordinary losses include:
- Unreimbursed financial charges: bank fees, unauthorized charges, costs of disputing fraudulent transactions
- Credit monitoring costs: the cost of a monitoring service you purchased specifically in response to the breach
- Lost time: up to 4 hours at $25 per hour to document time spent dealing with breach-related issues, such as contacting your bank, placing fraud alerts, or disputing unauthorized charges
- Other out-of-pocket expenses directly related to the breach: postage, phone charges, travel to a branch
Supporting documentation is required: receipts, bank statements, credit card statements, phone records, or similar records that show what you spent and when.
Option 3: extraordinary documented losses, up to $10,000
For class members who suffered significant financial harm they can trace directly to the breach.
Extraordinary losses require documentation showing a proven monetary loss or professional fees paid because of the breach: identity theft losses, costs of professional assistance to restore your identity, fraudulent tax returns filed in your name, fraudulent benefit claims, or similar documented events.
This tier is available but the burden of proof is substantial. Most class members will file under the flat $100 or the ordinary loss tier.
Credit monitoring for all class members
Every valid class member, regardless of which cash tier you choose, is eligible for:
- 2 years of credit monitoring
- Dark web monitoring
- Identity theft protection
- Up to $1,000,000 in identity theft insurance
Given that Social Security numbers and financial account information were potentially exposed, this benefit has real value independent of the cash. The administrator will provide activation details after your claim is processed.
How to file before the deadline
The deadline is October 8, 2026. This is tomorrow.
Step 1: Find your notice letter from Ernst and Young. The letter contains your Claimant ID and PIN.
Step 2: Go to MOVEitSettlementEYBOA.com.
Step 3: Click “File a Claim” and complete the claim form. Select the cash tier that applies to your situation.
Step 4: For the flat $100 tier, submit. For the ordinary or extraordinary loss tiers, attach your supporting documentation.
If you cannot find your notice letter: call the administrator at 888-295-3216 or write to RG/2 Claims Administration LLC to request your Claimant ID and PIN. Do this today given the deadline.
Mailed claims must be postmarked by October 8, 2026.
Key dates
| Date | Event |
|---|---|
| May 27-31, 2023 | MOVEit breach occurs |
| September 8, 2026 | Opt-out and objection deadlines (passed) |
| October 8, 2026 | Claim deadline (online or postmarked) |
| October 15, 2026 | Fairness hearing, 1:00 p.m. |
What comes out of the fund
Like all class action settlements, the gross fund is not the net fund.
Class counsel will apply to the court for attorneys’ fees plus costs and expenses. Representative plaintiffs may receive service awards. Administration costs also come out of the fund before distribution.
What remains is the net settlement fund distributed to class members who filed valid claims.
The fund is small. Is it worth filing?
The math is straightforward. With approximately 198,667 class members eligible and a $2.5 million fund, the flat $100 tier faces obvious pressure if everyone files. But most people do not file class action claims. Participation rates in data breach settlements frequently run well under 10%.
If you have 5 minutes and the notice letter, the flat $100 option costs you almost nothing to attempt. The credit monitoring benefit alone can be worth more than the cash if your data was genuinely exposed.
The documented loss tiers require real effort to substantiate and may not be worth it unless your losses are clear and documented. If you were the victim of identity theft after the breach, however, the $10,000 extraordinary loss tier is worth pursuing properly.
For settlements currently accepting claims and paying more per person, see our list of open class action settlements and our guide to settlements with no proof required.
MOVEit settlement scams
The MOVEit breach was one of the largest of 2023 and generated significant news coverage. That visibility makes it a natural fraud target.
- The only official site is MOVEitSettlementEYBOA.com. File nowhere else
- No one legitimate charges a fee to file your claim or expedite payment
- No one can guarantee your payout amount before claims close and the fund is allocated
- The claim window closes October 8. Anyone offering to file after that is not legitimate
- Do not share your Social Security number or bank credentials with anyone who contacts you about this settlement unsolicited
If you believe you have been targeted by fraud related to this settlement, report it at ReportFraud.ftc.gov. Our guide to spotting class action settlement scams covers the warning signs in more detail.
Is the payment taxable?
It depends on the tier.
Documented loss reimbursements (ordinary and extraordinary) return money you actually spent, which generally points away from taxable income.
The flat $100 no-proof payment is paid without proof of specific loss. Payments in this structure can be treated as ordinary income, though at $100 the question is mainly academic.
Credit monitoring is a service benefit rather than cash and is not normally taxable.
For guidance, see our article on whether settlement money is taxable and the IRS publication on tax implications of settlements and judgments.
Frequently asked questions
How do I know if I qualify for the MOVEit EY BofA settlement?
You qualify if you received a notice letter from Ernst and Young about your Bank of America personal information being exposed in the 2023 MOVEit breach. The letter includes a Claimant ID and PIN that you need to file.
What if I lost my notice letter?
Call the settlement administrator at 888-295-3216 today. Given the October 8 deadline, there is no time to wait. You can also write to RG/2 Claims Administration LLC in Philadelphia, PA, but calling is faster.
Is this the same as the Progress Software MOVEit settlement?
No. This settlement covers EY and Bank of America only. Claims against Progress Software Corporation, the company that made MOVEit, are proceeding in separate MDL litigation. If you received notices about MOVEit breaches at different companies, each has its own legal proceeding.
What is the $100 per person limit?
$100 is the stated payment for the flat no-proof cash tier. All payments are pro rata, meaning the actual amount can adjust up or down based on how many valid claims are filed and what the net fund is after fees and costs. The $100 figure assumes a specific claims volume; it could pay more or less.
What did EY and Bank of America actually do wrong?
Plaintiffs allege they failed to adequately protect customer data, specifically by using software with a known vulnerability type and failing to have sufficient safeguards in place. EY and Bank of America deny wrongdoing. The court has not decided who is right. The settlement resolves the claims without any finding of liability.
When will I get paid?
No payment date has been set. The fairness hearing is October 15, 2026. Payment follows court approval and the expiration of any appeal period. Realistically, early to mid 2027 is the earliest practical window, assuming no appeals. See our guide on how long class action settlement payments take.
Can I still file after October 8?
No. The claim deadline is October 8, 2026. There is no late filing provision described in the settlement documents.
This article is general information, not legal advice. Settlement terms, eligibility and deadlines are set by the court and the claims administrator. Verify current information at MOVEitSettlementEYBOA.com before filing. The October 8, 2026 deadline is tomorrow