EY and Bank of America agree $2.5 million MOVEit data-breach settlement
Proposed US settlement covers nearly 200,000 people whose personal information may have been exposed through EY’s use of MOVEit, as the firm faces a separate 2026 breach lawsuit in New York
EY and Bank of America have agreed to establish a $2.5 million settlement fund to resolve claims arising from the 2023 MOVEit data breach.
The case concerns a vulnerability in Progress Software’s MOVEit Transfer product, which EY used to handle information supplied by Bank of America. Cybercriminals gained access to the software between 27 and 31 May 2023, potentially exposing personally identifying information belonging to Bank of America customers.
The proposed settlement covers an estimated 198,667 people in the United States whose information was included in the affected files. EY and Bank of America deny wrongdoing and agreed to settle without the court deciding whether either defendant was liable. Claims against Progress Software have not been resolved and will continue separately.
Eligible class members may claim documented ordinary losses of up to $2,500 and extraordinary losses of up to $10,000. Alternatively, they may request an estimated $100 cash payment. Two years of identity-theft protection are also available, although payments may be adjusted depending on the number and value of approved claims.
Claims must be submitted by 8 October 2026. A final approval hearing is scheduled for 15 October 2026, meaning the settlement is not yet final and payments will not be issued unless the court approves it and any appeals are resolved.
The development comes as EY faces a separate cybersecurity controversy.
Earlier this month, the firm disclosed that an unauthorised party had accessed a third-party IT service-management platform used to support its tax teams and downloaded documents containing client tax and financial information. The access occurred between 28 March and 12 April 2026 and was detected on 23 April.
A proposed class action was subsequently filed in the Southern District of New York by Illinois resident Markishi Wyatt. The complaint alleges that EY failed to protect sensitive information and exposed affected individuals to identity theft, financial fraud and tax fraud. EY said it had secured its systems and was not aware of misuse of the information; the allegations have not been proven. This newer lawsuit is separate from the MOVEit settlement.
Related coverage
Ernst & Young, Bank of America $2.5M MOVEit Data Breach Settlement — Claim Depot, 22 July 2026
Explains who qualifies for the proposed settlement, the compensation options available and the deadlines for submitting claims.
MOVEit Security Incident Class Action Settlement — Official settlement website, 2026
Provides the court-authorised settlement information, including eligibility, available benefits, the claim process and the final approval hearing.
Bank of America, Ernst & Young Pay $2.5 Million in MOVEit Case — Bloomberg Law, 23 April 2026
Reports on the agreement reached by EY and Bank of America and their joint responsibility for funding the proposed settlement.
$2.5M Settlement Resolves Claims Against Ernst & Young, Bank of America Over May 2023 MOVEit Data Breach — ClassAction.org, July 2026
Summarises the litigation, settlement terms and compensation potentially available to people affected by the breach.
EY hit with proposed class action over data breach — CFO Dive, 21 July 2026
Covers the separate 2026 breach and the newly filed New York lawsuit alleging failures to protect client tax and financial information.
Want to stay up to date on all things Big Four around the world?
Check out the News section and subscribe to Big4News for weekly deep dives and briefings.