The mass data breach that swept through the MOVEit file-transfer software in 2023 has produced another payout, this one tied to Bank of America customer records. A class-action settlement now lets affected individuals claim a flat cash payment without documenting a loss, along with two years of identity-theft protection. The catch is a firm deadline in early October, after which the option disappears.
What the MOVEit breach settlement resolves
The settlement grows out of the May 2023 security incident, when cybercriminals exploited a vulnerability in the MOVEit Transfer software that many organizations used to move sensitive files. Ernst & Young had used the software to handle certain Bank of America data that included personally identifying information belonging to some of the bank’s customers. The resulting lawsuit, captioned Morris v. Progress Software Corporation and filed in federal court in Massachusetts, alleged negligent data-security practices. The defendants deny wrongdoing but agreed to a $2.5 million fund. According to the official settlement administrator, eligible class members are living U.S. residents whose information was included in the files affected by the incident.
Free retirement updates: Enrollment and claim windows come and go, and missing one can cost you real money. The free Retirement Shield newsletter keeps you ahead of the deadlines that matter. Sign up free.
The $100 flat payment versus documented reimbursement
Class members choose between two benefit paths. The first reimburses qualifying documented ordinary losses up to $2,500, plus documented extraordinary losses — such as out-of-pocket costs from identity theft — up to $10,000. The second is a straightforward alternative cash payment of $100 that requires no proof of loss. Both amounts are subject to pro rata adjustment depending on how many valid claims come in, meaning the final figure could move up or down. Separately, every class member may also claim two years of identity-theft protection services, a benefit that has value regardless of which cash option is selected.
The documented-loss path is broader than it first appears. Beyond direct fraud costs, it can cover ordinary out-of-pocket expenses tied to protecting oneself after the breach, and the settlement also allows a claim for time lost dealing with the fallout, compensated at a set hourly rate for a capped number of hours. A claimant who chose the documented route would need to keep records, receipts, statements, or a short accounting of the hours spent, while the flat alternative payment trades a potentially larger recovery for the certainty of a no-proof check.
The October 8 claim deadline and other key dates
A claim form must be submitted online or postmarked by October 8, 2026. The long-form notice details the filing process and the other dates that govern the case. Anyone who wants to exclude themselves from the settlement or object to it must act by September 8, 2026, and the court has set a final approval hearing for October 15, 2026, at the federal courthouse in Boston. The administrator has also flagged a practical wrinkle for mailed claims: recent changes to how the Postal Service applies postmarks mean a form mailed close to the deadline could be stamped a few days late, so filing online is the surer route for anyone near the cutoff.
How this fits into the larger MOVEit fallout
The Bank of America matter is one piece of a far larger event. The 2023 attack on the MOVEit file-transfer tool ranks among the biggest data-exposure incidents of the decade, reaching thousands of organizations that used the software and the personal records of tens of millions of people, because so many companies relied on a single vendor’s product to move sensitive files. When one widely used piece of software is compromised, the damage radiates outward through every business that touched it, which is how a bank’s customers can be swept into a breach that originated with a contractor’s file transfers rather than the bank’s own systems. That structure is also why separate settlements, deadlines, and administrators can arise from the same underlying hack, and why one person may receive more than one breach notice tied to the same 2023 event.
Why older account holders should not shrug off a small check
A $100 payment will not, on its own, change anyone’s finances. The more durable exposure from a breach of this kind is the long tail: names, account details and other identifiers can circulate for years and surface later in fraud attempts, which is why the two years of credit and identity monitoring may matter more than the cash. Older bank customers are frequent targets of the scams that follow stolen data, from impostor calls to account-takeover attempts, so the monitoring benefit is worth claiming even for those inclined to skip the payment. Filing takes minutes and does not require producing receipts if the flat option is chosen.
The identity-theft protection is not automatic. A class member must claim it on the same form and then activate the service once the administrator sends enrollment details, a step some eligible people miss by assuming the coverage simply switches on. Because the monitoring runs for two years from activation, claiming it promptly is what turns a paper benefit into real coverage during the window when stolen 2023 data is most likely to be tested against a victim’s accounts.
Checking eligibility before the window shuts
The controlling terms — who is covered, how to file and what proof each option requires — are published by the court-approved administrator rather than by any third-party summary. Customers who received a notice can use the claimant ID and PIN it provided to file online, and those unsure of their status can review the class definition directly. With the claim period ending October 8, the operative point is the calendar: once that date passes, both the cash payment and the monitoring benefit are off the table.
This article was produced with the assistance of artificial intelligence and reviewed by The Financial Wire editorial team.
More Financial Reading
- How many CDs can you park at 1 bank? FDIC rules you must know
- The ideal retirement withdrawal rate so your savings actually last
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
