Somewhere in a drawer, in a folder of things you meant to deal with, or long since thrown out, there may be a letter from Ernst & Young telling you that your personal information turned up in a 2023 data breach. That piece of mail is the eligibility key to a $100 payment. It carries the Claimant ID and PIN that open the claim form in a settlement covering people whose Bank of America records were sitting in files Ernst & Young was handling when the MOVEit hack hit, and the window to file closes October 8, 2026.
The Ernst & Young letter is what establishes you are in the class
This is not a settlement open to every Bank of America customer, and that distinction matters before you spend any time on it. The class is defined narrowly by whose records were actually in the affected files, which in practice means the people the notice went out to.
The court-approved settlement site puts the eligibility question in one sentence: if you received notice from Ernst & Young that your personally identifying information was potentially compromised in the 2023 MOVEit incident, you may be entitled to a payment. The formal class definition in the notice published by the settlement administrator is all living persons in the United States whose personal information was included in the files affected by the incident, with the usual carve-outs for the defendants, their officers and the judge.
Free retirement updates: Miss an enrollment or claim deadline and it may be gone. Our free Retirement Shield newsletter keeps readers ahead of the ones that matter. Get the free newsletter.
Two claim paths, and only one of them asks for receipts
You have to pick one lane. The first pays back money you can document: qualifying ordinary losses up to $2,500, which includes up to four hours of lost time valued at $25 an hour, and qualifying extraordinary losses up to $10,000 for proven, unreimbursed monetary damage tied to the breach. Ordinary losses cover the small stuff people rarely think to keep receipts for, including bank fees, postage, metered phone and data charges, and gas for local trips. Extraordinary losses require documentation, and the notice is explicit that a personal statement on its own does not count as reasonable documentation.
The second lane is the one most people will want. In place of filing for reimbursement, a class member may claim a flat cash payment of $100 “without the need to document losses or attest to time spent” as a result of the incident. No receipts, no bank statements, no accounting of hours. Separately, and regardless of which lane you choose, every class member can also claim two years of three-bureau credit monitoring that includes dark web monitoring and $1 million in identity theft insurance.
What could push the $100 up, and what could pull it down
The $100 is a starting figure, not a guarantee, and the mechanism that moves it runs in both directions. Ernst & Young and Bank of America are paying $2,500,000 into a settlement fund, and that single pot has to cover every valid claim plus notice and administration costs, a service award to the class representative of no more than $2,500, and class counsel’s fees, which counsel has said it will ask the court to set at up to one-third of the settlement.
If the approved claims add up to more than what is left after those deductions, payments get cut proportionally. If they add up to less, the flat cash payments are increased proportionally, up to a ceiling of $1,000. Nobody can tell you today which side of that line the final numbers will fall on, and the notice does not project it. Money still sitting in the fund 180 days after the settlement takes effect goes toward extending the credit monitoring rather than back to the companies.
October 8 to claim, September 8 to walk away
The claim form must be submitted online or postmarked by October 8, 2026, and the online form requires the Claimant ID and PIN printed on your notice. If you believe you are a class member but no longer have that paperwork, the administrator, RG/2 Claims Administration, takes questions by email and at 888-295-3216.
The administrator has also posted an unusual warning about mailed claims. Since a December 2025 change to how the Postal Service dates postmarks, a form mailed close to the deadline may carry the date it reached an automated processing facility rather than the date the Postal Service received it, which can turn an on-time claim into a late one. If you are filing on paper, mail early. The other date on the calendar is September 8, 2026, the deadline to opt out and keep your right to sue on your own, or to object to the deal.
What this settlement does not resolve
Be precise about what happened here, because the shorthand version circulating online is wrong. Bank of America’s own systems were not the point of entry. Between May 27 and May 31, 2023, attackers exploited a flaw in MOVEit Transfer, a file transfer product made by Progress Software that Ernst & Young used in the ordinary course of business to handle certain Bank of America data. CISA and the FBI later published a joint advisory describing how the CL0P group exploited an SQL injection vulnerability in MOVEit Transfer beginning in May 2023 to steal data from the underlying databases.
Both defendants deny any wrongdoing, and the claims against Progress Software itself are not resolved by this deal. That litigation continues. The case is Morris v. Progress Software Corporation et al., No. 1:24-cv-11807-ADB, in the U.S. District Court for the District of Massachusetts, coordinated with the broader MOVEit multidistrict litigation. Judge Allison D. Burroughs is scheduled to hold the final approval hearing at 1 p.m. on October 15, 2026, in Boston, and the notice is direct about the timing that follows: payments go out only after the court approves the settlement and any appeals are resolved.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
More Financial Reading
