Bank of America customers affected by a 2023 data breach can claim either a flat $100 payment or reimbursement for documented losses up to $12,500, under a $2.5 million class action settlement with Ernst & Young and Bank of America. The payout tied to a settlement notice posted on openclassactions.com resolves claims that the companies failed to protect consumers' personal information during a May 2023 breach of the MOVEit Transfer file-sharing software. The claim window has already closed, and a federal judge is weighing final approval of the deal. Here's who the settlement covers, what the payment options actually mean, and what's left to happen before anyone gets paid.
Official resources:
- Explore the official data from Openclassactions — Use this primary source to review the underlying data.
- Read the official notice from Moveitsettlementeyboa — Use this primary source to verify the official announcement.
Table of Contents
- What the Settlement Covers
- How Much You Can Actually Claim
- Documented Losses — Ordinary vs. Extraordinary
- Why $12,500 Is a Ceiling, Not a Guarantee
- Non-Cash Benefits and What Happens Next
- Frequently Asked Questions
What the Settlement Covers
The breach happened between May 27 and May 31, 2023, when attackers exploited a security flaw in Progress Software's MOVEit Transfer product, which Ernst & Young and Bank of America used to exchange files containing customer data. Ernst & Young performed services for Bank of America that required moving sensitive personal information between the two companies, and that transfer process is what attackers compromised. The settlement class is defined narrowly: living U.S.
residents whose personal information was in the files exchanged between Ernst & Young and Bank of America and who were affected by that specific May 2023 incident. Court filings estimate roughly 198,667 people fall into that group, according to the same openclassactions.com settlement summary. Being a Bank of America customer during that period doesn't automatically qualify someone — the exposure has to trace specifically to this file-transfer incident.
How Much You Can Actually Claim
Eligible class members choose one of two payment paths, not both. The simplest option is a flat $100 cash payment that requires no documentation or proof of loss — anyone in the class qualifies by filing a claim. The alternative is reimbursement for documented losses actually tied to the breach, which can run much higher but requires paperwork to back it up.
That second path is where the headline $12,500 figure comes from. It's a combined ceiling across two separate categories of documented loss, not a flat amount every claimant can expect to receive. Choosing it only makes sense for someone who can show real, breach-related costs or harm that add up to more than the no-questions-asked $100.
Documented Losses — Ordinary vs. Extraordinary
Ordinary losses cover everyday costs tied to the breach: bank fees, phone or mail charges related to dealing with the fallout, credit-monitoring expenses already paid out of pocket, and up to four hours of lost time valued at $25 an hour. Those claims are capped at $2,500 per person.
Extraordinary losses cover more serious harm, such as documented identity theft or fraud traceable to the breach, and are capped separately at $10,000 per claimant. Added together, the ordinary and extraordinary caps produce the up-to-$12,500 maximum total payout that defines this settlement, as described in openclassactions.com's breakdown of the claim options. Reaching that ceiling requires both significant documented identity theft and separate ordinary expenses — most claimants with real but modest losses will land well under it.
Why $12,500 Is a Ceiling, Not a Guarantee
Every cash payment under this settlement — the flat $100 and the documented-loss claims alike — comes out of the same $2.5 million fund. If approved claims in total exceed that amount, every payment is reduced on a pro rata basis, meaning each claimant gets a percentage of what they were otherwise owed rather than the full amount. With nearly 199,000 people potentially eligible, that reduction is a real possibility, not a technicality.
Practically, this means the $100 flat payment and the $12,500 ceiling are both best-case figures. Someone approved for $10,000 in extraordinary losses could still receive less if the fund is oversubscribed. Filing with solid documentation improves the odds of a claim being approved at all, but it doesn't protect against a proportional cut if total demand outstrips the settlement amount.
Non-Cash Benefits and What Happens Next
Separate from the cash options, claimants also qualify for two years of credit monitoring and identity-theft protection services. That benefit applies regardless of which cash option someone chose, and it doesn't count against the $2,500 or $10,000 caps. Claims had to be submitted online or postmarked by October 8, 2026, through the settlement website, using the Claimant ID and PIN from the mailed notice, or by mailing in a paper form, per the court-approved long-form settlement notice.
The deadline to opt out or object was September 8, 2026, and a final approval hearing before Judge Allison D. Burroughs in federal court in Boston is scheduled for October 15, 2026. No payment date has been set, because final approval had not yet been entered as of that hearing.
Frequently Asked Questions
Do I have to choose between the $100 payment and the documented-loss claim?
Yes. Claimants pick one option — the flat $100 with no documentation, or reimbursement for documented ordinary and extraordinary losses up to a combined $12,500.
Is the credit monitoring offer separate from the cash payment?
Yes. The two years of credit monitoring and identity-theft protection apply regardless of which cash option a claimant selects.
Could my payment be less than what I was approved for?
Possibly. All cash payments are reduced on a pro rata basis if total approved claims exceed the $2.5 million settlement fund.
When will payments go out?
No payment date has been announced. A final approval hearing was scheduled for October 15, 2026, and payments depend on that approval being entered.