Fidelity to settle data breach class action lawsuit for $2.5 million

Fidelity Investments Life Insurance Company has received preliminary approval from a federal judge to settle a class action lawsuit arising from a major data breach in 2024 that compromised the personal and financial information of about 155,000 individuals.

 

The Boston, Massachusetts-based financial services company, that has more than $15 trillion in assets under administration and offers wealth management and insurance services, suffered a major data breach incident in August 2024 that enabled malicious actors to steal the names and other personal identifiers of about 155,000 individuals.

 

Fidelity initially revealed in its filing with the Maine state regulator that at least 77,099 individuals were impacted by the incident, but later revised the figure to more than double the initial estimates, including 86,000 individuals whose bank account and routing numbers were accessed by the hackers. The company promised to provide two years of complimentary identity protection and credit monitoring services through Transunion to all affected individuals.

 

The significant data breach quickly attracted a class action lawsuit on behalf of the affected individuals on February 10, 2025. The lawsuit alleged that the financial services provider did not implement necessary cyber security safeguards to protect the personal information of its customers, including their names, Social Security numbers, financial account numbers and driver’s licence numbers.

 

The lawsuit filed by Yaakov and Seth Gluck from Spring Valley, New York, also alleged that Fidelity failed to detect the incident or notify its customers promptly. The company sought to downplay its failure, stating that fewer than 0.15% of its customers were affected and there was no indication of misuse of the stolen data online.

 

Fidelity initially filed a motion to dismiss the class action lawsuit and litigation proceedings continued till August 25, 2025, when the judge stayed all litigation proceedings to allow the parties to negotiate a settlement. 

 

In October, the plaintiffs and Fidelity Investments reached an agreement in principle where the financial services company will create a common fund to settle the class-action lawsuit without admitting any responsibility for the data breach incident. The common fund would pay for attorney fees as well as compensation for each affected individual, based on the extent of the harm they suffered.

 

"Fidelity has concluded that further defense of the Action would be protracted and expensive, and that it is desirable that the Action be fully and finally settled in the manner and upon the terms and conditions set forth in this Settlement Agreement," the agreement read.

 

As per the settlement terms, class action members may receive up to $5,000 per claim if they produce documented records of losses suffered in addition to a pro rata cash payment estimated to be around $100. All class action members will also get two years of credit monitoring and identity theft protection services, including up to $1 million in fraud and identity theft insurance coverage.