$2.5M Ernst & Young, Bank of America MOVEit data breach class action settlement

Ernst & Young and Bank of America agreed to pay $2.5 million as part of a class action settlement to resolve claims that they failed to protect consumers from a 2023 data breach of the MOVEit file transfer service.

The Bank of America settlement benefits individuals whose personally identifiable information (PII) was included in the MOVEit data breach that occurred between May 27 and May 31, 2023.

The data breach reportedly occurred when hackers gained access to the MOVEit file transfer software used by Ernst & Young and other companies. According to the data breach class action lawsuit, EY failed to implement reasonable cybersecurity measures to protect its clients from the breach.

Ernst & Young is a global consulting firm that provides financial services, including auditing, tax and advisory. Bank of America is a financial institution that offers banking, investing, asset management and other financial services.

Ernst & Young and Bank of America have not admitted any wrongdoing but agreed to a $2.5 million class action settlement to resolve these allegations.

Under the terms of the Bank of America settlement, class members can receive reimbursement for ordinary and extraordinary losses resulting from the data breach.

Class members can receive up to $2,500 for ordinary losses, including bank fees, communication charges, credit monitoring costs, up to four hours of lost time at a rate of $25 per hour and other documented losses. Class members can receive up to $10,000 for extraordinary losses, including unreimbursed fraudulent charges, identity theft damages and other documented monetary losses.

Class members who did not experience any losses as a result of the data breach can receive an alternative cash payment of $100.

All class members can receive two years of free credit monitoring and identity theft protection services.