Finding out that your financial information might have been compromised—not on the day it occurred, but almost two months later—is somewhat unsettling. Following a cyberattack on the company’s network between August 17 and 19, 2024, thousands of Fidelity Investments clients were put in that predicament. More than 77,000 people nationwide were impacted by the breach, and Fidelity admitted in court that it had not informed customers until much later.
This was particularly important to Texans. Since Fidelity has offices in San Antonio, Austin, and a number of other significant Texas cities, a sizable portion of the impacted clients were residents and employes of the state. Many people’s first thoughts upon the court’s approval of a $2.5 million class action settlement were straightforward: do I qualify, and how much could I get?
On paper, eligibility for the Texas Fidelity settlement wasn’t all that difficult, but the specifics were important. The two primary groups covered by the settlement were any U.S. citizens who were officially informed about the data security incident by Fidelity and any other U.S. citizens whose bank account and routing numbers were compromised during the breach. A particular rule applied to joint account holders: each compromised account could only have one claim, not one per individual. Before filing, it’s important to carefully read that kind of fine print.
Only claimants who could prove actual out-of-pocket losses related to the breach—such as fraudulent charges, expenses incurred while restoring a compromised identity, or time spent dealing directly with the fallout—were eligible for the $5,000 maximum payout. The settlement still had something to offer people without that type of paperwork. Regardless of whether they had evidence of specific harm, eligible members could receive a smaller pro rata cash payment, estimated to be between $100 and $150. It acknowledged that the breach occurred and that it affected actual people’s lives, but it’s not a windfall.
In addition to the money, all qualified class members were eligible for two years of free credit monitoring and identity theft protection thru a program called CyEx, which included up to $1 million in fraud and identity theft insurance. Although that aspect tended to receive less attention than the monetary figures, it was probably the more useful benefit for someone who actually cared about what happened to their data.
The lawsuit itself brought up a question that is increasingly common in cases involving data breaches: who is accountable when a company’s security fails? The plaintiffs contended that the breach could have been avoided and that Fidelity’s systems were not sufficiently protected. According to three of the named plaintiffs, their data ended up on the dark web. Citing the unpredictability of litigation, Fidelity agreed to settle despite denying any wrongdoing. This is a fairly common response in situations such as this one. The business moves on after the issue is resolved without an admission.
Even after the settlement was announced, it was genuinely unclear how many eligible Texans actually submitted a claim prior to the deadline of July 27, 2026. Participation rates in class actions are generally low. People either don’t realize they qualify, miss notices, or believe the payment isn’t worth the effort. It’s possible that a sizable portion of San Antonio or Austin residents who were notified of Fidelity’s breach simply missed the deadline.
If there is a more general trend to be aware of, it is that data breaches at major financial institutions are becoming more frequent occurrences. They keep happening. The settlements that follow the Fidelity case, which is one in a long line of similar incidents, typically provide meager compensation in relation to the extent of the disruption. Regardless of whether a settlement check ever arrives, it’s still worthwhile to monitor your accounts, freeze your credit, and keep an eye out for any unusual activity because the next breach is unlikely to reveal itself beforehand.
