EY & Bank of America MOVEit Security Incident Settlement (Morris v. Progress Software)
What this is about
Between May 27 and May 31, 2023, cybercriminals exploited a vulnerability in the MOVEit Transfer file-transfer software used by EY, potentially accessing personally identifying information EY handled for Bank of America customers.
The background
Morris v. Progress Software Corporation, et al., Case No. 1:24-cv-11807-ADB, pending in the United States District Court for the District of Massachusetts. The settlement resolves claims against Ernst & Young LLP and Bank of America Corporation arising from the May 2023 MOVEit Transfer security incident, in which a vulnerability in the third-party file-transfer software exposed personally identifying information EY handled for BOA customers. Claims against Progress Software itself remain unresolved and the litigation continues. Settlement class members who file a timely, valid claim form can receive up to $2,500 for documented ordinary losses incurred between May 31, 2023 and October 8, 2026.
Worth knowing
Morris v. Progress Software Corporation, et al., Case No. 1:24-cv-11807-ADB, pending in the United States District Court for the District of Massachusetts. The settlement resolves claims against Ernst & Young LLP and Bank of America Corporation arising from the May 2023 MOVEit Transfer security incident, in which a vulnerability in the third-party file-transfer software exposed personally identifying information EY handled for BOA customers. Claims against Progress Software itself remain unresolved and the litigation continues. Settlement class members who file a timely, valid claim form can receive up to $2,500 for documented ordinary losses incurred between May 31, 2023 and October 8, 2026.
File your claim on the official site →Common questions
How much can I get from the EY & Bank of America MOVEit Security Incident Settlement (Morris v. Progress Software)?
Up to $2,500 for documented ordinary losses (plus up to $250 for lost time); $2.5M total fund
What happened in the EY & Bank of America MOVEit Security Incident Settlement (Morris v. Progress Software) case?
Between May 27 and May 31, 2023, cybercriminals exploited a vulnerability in the MOVEit Transfer file-transfer software used by EY, potentially accessing personally identifying information EY handled for Bank of America customers.
How do I actually file a claim?
Use the official claim link on this page — it goes directly to the real claims administrator or court-approved site. We never collect claim submissions ourselves and never charge a fee to help you file.
Where does this information come from?
This entry was last verified on August 21, 2026 against its primary source (the official claims administrator, court record, or government page) — linked below. We re-check it, not just copy it once.
Want to know when settlements like this open up?
We check for new Data Breach & Privacy claims daily. Tell us your email and we'll send a weekly rundown of what's new — no spam, unsubscribe anytime.