Fidelity Investments and its subsidiary, Fidelity Brokerage Services, agreed to a settlement on May 13, closing the door on a lawsuit that alleged the investment giant failed to prevent a cyberattack and alert members afterward.
In their complaint, the plaintiffs alleged that Fidelity detected suspicious activity on its network between Aug. 17 and Aug. 19, 2024. Calling the breach “preventable,” they claimed Fidelity’s “inadequately secured computer systems” allowed attackers to gain entry. According to their filing, some 77,099 individuals had data compromised, including Social Security numbers, driver’s licenses, and financial account information.
Court documents indicate approximately 86,000 more customers whose bank account and routing numbers were exposed may also be eligible for the settlement, even if they weren’t directly notified. The plaintiffs allege that, as a result of the breach, they suffered fraud, lower credit scores, and exposure of their personally identifiable information on the dark web.
Fidelity has denied any wrongdoing but said it agreed to settle because of “the uncertainty and risks inherent in any litigation.” “We remain fully committed to the security of our clients’ accounts and personal information,” the company told CNBC Select in a statement. “Litigation can involve a considerable amount of time and resources, [and] a settlement is one way to avoid this for both parties.”
Class members could number more than 160,000, including those notified of the breach and others whose bank account and routing numbers were allegedly exposed. Eligible class action members may receive up to $5,000, depending on the nature of their losses. The deadline to be excluded from the settlement was June 26, 2026.
The settlement was approved in a final fairness hearing on July 9, 2026. If there are no appeals, attorneys’ fees and the lead plaintiffs will be paid first. Proof of losses stemming from the breach is not required to file a claim. Class members who cannot document losses may receive approximately $100 in cash payments, depending on the number of claims filed. California residents may be able to claim an additional $50 under the California Consumer Privacy Act.
If you can prove that you suffered financial losses directly linked to the breach, you could be eligible for a payment of up to $5,000. The losses must have occurred between August 17, 2024, and July 27, 2026. Unless you opted out, you are still automatically part of the settlement. But if you do not file a claim by July 27, 2026, you will not receive benefits or payments and you will give up the right to be part of another lawsuit related to the legal claims in this case.
The settlement follows a data security incident involving the financial services company, which has offices in San Antonio, Austin, and other major Texas cities. Between August 17, 2024, and August 19, 2024, a third party viewed and obtained certain information from Fidelity’s computer network without authorization, according to the complaint. The company waited two months before notifying consumers of the breach, according to court documents. Three of the plaintiffs allege that their information was published on the dark web.
“Based on a subject forensic investigation, Fidelity determined that the unauthorized third party potentially accessed certain personal information,” the settlement website states. “The personal information varied by individual and may have contained names, Social Security numbers, financial account information, and/or driver’s license information.”
Plaintiffs from several states, including California, New York, and Florida, filed a complaint in February 2025, alleging that Fidelity Investments failed to properly secure its computer network and that the data breach was preventable. The complaint also states that this is a class action lawsuit, meaning the plaintiffs represent both themselves and other similarly situated persons.
Class members can attend the final fairness hearing, but do not have to remain eligible for future payment. The hearing was held at the United States District Court for the District of Massachusetts. Where joint account holders had a single financial account number and routing number compromised, only one claim is permitted under the settlement.
