In the span of 48 hours in August 2024, an unauthorized attacker sent approximately 23.7 million automated requests to Fidelity Investments’ systems and walked away with around 373,000 document images. Those documents contained names, Social Security numbers, financial account details, and driver’s license information belonging to roughly 155,000 people.
Fidelity settled the resulting class action lawsuit for $2.5 million. The court gave final approval on July 9, 2026. The claim deadline passed on July 27, 2026, and no new claims can be submitted. If you filed before that deadline, your payment is being processed.
At a glance
| Settlement fund | $2,500,000 |
| People affected | ~155,000 |
| Breach dates | August 17–19, 2024 |
| Claim deadline | July 27, 2026, now closed |
| Final court approval | July 9, 2026 |
| Payments expected | Within 30 days of fund distribution determination |
| Administrator phone | (833) 386-6470 |
| Administrator email | info@FidelityDataSettlement.com |
| Case | In re: Fidelity Data Breach Litigation, No. 1:24-cv-12601, D. Massachusetts |
What Actually Happened in the Breach
Most news coverage of this breach described it in vague terms: “unauthorized access,” “cybersecurity incident.” The Massachusetts Securities Division, which investigated Fidelity separately from the class action, was more specific.
According to the regulator’s consent order, the attacker gained access to Fidelity’s systems and ran approximately 23.7 million automated requests over the course of August 18–19, 2024. Those requests pulled roughly 373,000 document images from Fidelity’s systems in less than two days.
The documents varied by individual, but potentially contained:
- Full legal names
- Social Security numbers
- Financial account information
- Driver’s license numbers
Approximately 155,000 individuals or joint account holders were affected.
The Massachusetts Securities Division concluded that Fidelity “did not reasonably enforce its technical security policies.” In plain terms: the controls that should have flagged or blocked 23.7 million requests in 48 hours apparently were not working the way they were supposed to.
There is a second finding that received almost no coverage in the media. The regulator found that Fidelity failed to provide notice of the data breach to certain Massachusetts residents, including beneficiaries and minors, even after the breach was discovered. Some affected people had no idea what happened to their information because Fidelity did not tell them.
What the Settlement Paid
The $2.5 million fund was structured in three tiers depending on what you could document:
Tier 1: Documented out-of-pocket losses, up to $5,000
If you experienced actual financial harm you could trace back to this breach, fraudulent charges, costs for credit monitoring you purchased on your own, fees for replacing a stolen ID, time spent dealing with identity theft, you could claim up to $5,000 with documentation such as receipts, bank statements, or a police report.
Tier 2: Cash payment for everyone else, approximately $100
Even without documentation, all eligible class members who filed a claim received a pro rata cash payment. Based on the fund size and the number of affected people, that estimate was approximately $100 per person, though the exact amount depends on how many valid claims were filed.
Tier 3: California residents, additional $50
California residents were entitled to an additional $50 payment under the California Consumer Privacy Act, on top of whichever tier above applied to them.
Credit monitoring for all class members
All class members who filed a claim also received two years of identity theft protection through CyEx Financial Shield, which includes $1 million in fraud insurance coverage. This did not require documented losses to claim.
What Happens Now
The court granted final approval on July 9, 2026. The claim deadline closed July 27, 2026. The settlement is now in the distribution phase, meaning the administrator is reviewing submitted claims, calculating the final per-person amounts, and preparing to issue payments.
If you filed a claim before July 27, 2026: The settlement agreement states that payments will issue within 30 days after the allocation and distribution of funds are determined. No specific payment date has been published. Checks become void 90 days after they are issued, so watch for anything from the Fidelity Data Security Incident Settlement in your mail and deposit it promptly.
If you received no notice and think you might have been affected: Contact the Massachusetts Securities Division. The regulator found that Fidelity failed to notify some affected residents. The settlement administrator can also tell you whether you were included in the class: call (833) 386-6470 or email info@FidelityDataSettlement.com.
If you missed the claim deadline: The window is closed. July 27, 2026 was firm and final approval has been granted. There is no late-filing process for a closed class action settlement.
Why Fidelity’s Settlement Fund Seems Small for 155,000 People
$2.5 million divided among 155,000 people is roughly $16 per person before legal fees and admin costs. The actual cash payment estimate of $100 per claimant makes more sense when you understand that not every affected person filed a claim. Class action participation rates are often low, depending on how easy the process was and how well the class was notified, the actual number of valid claims filed may be a fraction of the total affected population.
There is also the documented-loss tier. Most class members had no out-of-pocket losses they could prove, so they filed for the flat cash payment and credit monitoring. A smaller number submitted documented claims. The administrator reviews each documented claim, and the final per-person math depends on how those are adjudicated.
The settlement also does not represent a full accounting of the harm. Class action settlements in data breach cases often undercompensate victims relative to the actual risk they face from exposed Social Security numbers, which can be used for identity theft for years after a breach. The settlement resolves the lawsuit; it does not eliminate the underlying risk to your personal information.
What to Do About Your Data Going Forward
Whether or not you filed a claim, your information was potentially exposed. A few things worth doing:
Place a credit freeze. A freeze with all three bureaus, Equifax, Experian, and TransUnion, is free, takes about five minutes per bureau, and blocks anyone from opening new credit in your name without your direct authorization. You can lift it temporarily when you need to apply for credit.
Check for unfamiliar accounts. Review your credit reports at AnnualCreditReport.com. You are entitled to free weekly reports from all three bureaus. Look for accounts or inquiries you do not recognize.
Be alert to tax fraud. Social Security numbers stolen in data breaches are frequently used to file fraudulent tax returns and collect refunds in victims’ names. If your return is rejected because one has already been filed under your Social Security number, contact the IRS Identity Protection Specialized Unit.
Monitor for targeted phishing. Breached data often circulates for months before being actively used. Emails, texts, or calls that reference your Fidelity account, your Social Security number, or specific account details should be treated as suspicious, even if they appear official.
Frequently Asked Questions
Can I still file a claim for the Fidelity data breach settlement?
No. The claim deadline was July 27, 2026, and the court granted final approval on July 9, 2026. The claims window is closed and no new submissions are accepted.
When will Fidelity settlement payments be sent out?
The settlement agreement states payments will be issued within 30 days after the fund allocation and distribution are determined following final approval. No specific payment date has been announced. If you filed a claim, monitor your mail and email for payment correspondence from the Fidelity Data Security Incident Settlement.
How much will I receive from the Fidelity settlement?
If you filed a claim for the flat cash tier, approximately $100, though the exact amount depends on how many valid claims were submitted and the deductions for legal fees and administrative costs. California residents receive an additional $50. People who filed documented loss claims could receive up to $5,000 depending on what they documented.
How do I know if my data was part of the breach?
Fidelity and the settlement administrator mailed and emailed notice to individuals identified as class members. If you received a notice with a unique ID and PIN, your information was in the breach. If you are unsure, call (833) 386-6470 or email info@FidelityDataSettlement.com to ask.
Why did some people not get notified about the Fidelity breach?
The Massachusetts Securities Division found that Fidelity failed to provide breach notification to certain Massachusetts residents, including beneficiaries and minors. If you believe you should have been notified and were not, contact the Massachusetts Securities Division or the settlement administrator directly.
Is this the same as the National Public Data breach?
No. The National Public Data breach and the Fidelity breach are separate incidents involving different companies. National Public Data was a background-check company whose 2024 breach exposed billions of records from its own database. The Fidelity breach affected approximately 155,000 Fidelity account holders’ information held directly by Fidelity Investments.
What should I do if my Fidelity settlement check expires before I cash it?
Settlement checks typically come with a 90-day expiration window. If your check expires uncashed, contact the settlement administrator at (833) 386-6470. Depending on the stage of distribution, a replacement may be available.
Claims are closed here — looking for open settlements? See our updated list of class action settlements currently accepting claims. For a plain-English guide to how data breach settlements work, read how class action settlements work.
This page is for general information only and is not legal advice. Settlement details are based on court-approved documents, the official settlement website at FidelityDataSettlement.com, and the Massachusetts Securities Division consent order. Always verify current payment status directly with the settlement administrator.