For three days. In August 2024, it took that long for an unauthorized third party to access Fidelity’s computer network and extract names, Social Security numbers, driver’s licenses, and financial account and routing numbers from thousands of customer files. Before anyone informed the individuals whose information had been stolen, there was a three-day period of access followed by almost two months of silence.
The subsequent lawsuit resulted in a $2.5 million settlement for Fidelity Customer Data, with a claim deadline of July 27, 2026, which has since passed. The actual breach took place between August 17 and August 19, 2024. Fidelity found suspicious activity, carried out a forensic investigation, and verified that customer data files had been compromised, according to court documents. The class action lawsuit focused on the company’s failure to notify customers until early October 2024.
Throughout the legal proceedings, Fidelity denied any misconduct. Rather than acknowledging that anything went wrong, the company characterized the settlement in its statements as a practical means of avoiding the expenses and inconvenience of ongoing legal proceedings. Although this framing is typical in corporate settlements and does not render them untrue, it also does not completely satisfy those whose Social Security number was left floating in a breach for two months without their knowledge.
An estimated class of over 160,000 individuals was covered by the settlement fund. This comprises the approximately 77,099 people that Fidelity notified directly, as well as the roughly 86,000 people whose routing numbers and financial accounts were compromised but who were not contacted because the breach did not, in theory, violate state-law notification requirements for their particular data. One of those details that is easy to ignore but worth considering is the possibility that tens of thousands of people could be eligible for a settlement without ever receiving direct notice.
The anticipated cash payment for the majority of eligible class members was approximately $100; the precise amount depended on the number of claims filed as well as which legal and administrative expenses were deducted first from the fund. The California Consumer Privacy Act provided an extra $50 to residents of California.
Claims for up to $5,000 could be submitted by anyone who could prove actual financial losses, such as fraud charges, identity theft expenses, credit monitoring fees, or time spent handling the fallout, as long as they had written records, statements, or receipts to support their claims. The settlement package also included $1 million in fraud and identity theft insurance through CyEx, as well as two years of credit monitoring.
This pattern has become so familiar that it is difficult to ignore it. The list of major companies that have resolved class action lawsuits related to data breaches over the past few years is lengthy and continues to grow, including Equifax, Flagstar Bank, Comcast, and Cash App.
Customers are frequently the last to know, a lawsuit ensues, a settlement is reached without acknowledging fault, and the majority of people leave with something between a small inconvenience payment and nothing at all. The dollar amounts and company names change, but the fundamental structure remains the same. It’s possible that the current system, as annoying as it may seem, is functioning roughly as well as anyone intended, or that the regulatory and legal framework simply hasn’t caught up with the scope of the issue yet.
On July 9, 2026, the settlement was finally approved by the court. On July 27, the deadline for filing passed. Following the resolution of any appeals, payments for those who filed claims on time should start to be made. Attorneys’ fees and lead plaintiff payments should be paid first, as is customary in class action distributions. The Settlement Administrator can be reached at info@FidelityDataSettlement.com or by phone at (833) 386-6470 by anyone who filed a claim and would like to inquire about its status.
After the checks are sent and the claims are processed, what’s left is an unanswered question. A $2.5 million settlement does not require Fidelity to improve its cybersecurity infrastructure or to what extent. It does, at the very least, add a cost to the incident, even if that cost barely shows up on a balance sheet when spread across a business that manages trillions of dollars’ worth of client assets. The math seems much less abstract to the specific customer whose routing number ended up in the wrong hands.
