Fidelity Investments has now paid twice for the same mistake. An August 2024 breach that exposed sensitive records tied to roughly 155,000 customers and related individuals has produced a $2.5 million class-action settlement and a separate $1.25 million penalty from a Massachusetts regulator, for a combined $3.75 million bill on a single incident. Bloomberg Law first reported in November 2025 that Fidelity had reached a preliminary settlement covering more than 75,000 affected customers, and Top Class Actions confirmed in March 2026 that the fund had been finalized at $2.5 million for a class of roughly 155,000 account holders. The class-action deal received final court approval on July 9, 2026, with the claims window closing July 27, 2026, according to Classaction.org. The regulatory fine, reported by The WealthAdvisor, landed separately and for a different legal reason entirely.
Two years after hackers first got in, the paper trail is finally closing. What it shows is a case study in how one broken access control at a $16 trillion asset manager can cascade into overlapping consumer litigation and state enforcement, each with its own math, its own deadline, and its own definition of who counts as a victim.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Two Settlements, One 2024 Breach
The confusion around this story starts with a simple fact: there are two separate Fidelity data breach settlements circulating in 2026 headlines, and they are not the same case. The first is a $2.5 million consumer class-action settlement resolving federal litigation in Massachusetts, covering documented losses up to $5,000 per claimant plus flat cash payments; ClaimDepot confirmed in April 2026 that eligible class members could claim up to that $5,000 ceiling from the fund. The second is a $1.25 million enforcement settlement with Massachusetts Secretary of the Commonwealth William Galvin, resolving allegations that Fidelity Brokerage Services failed to safeguard client records under state securities law.
Both trace back to the identical intrusion window: August 17 to August 19, 2024. Both settlements avoid an admission of wrongdoing. Fidelity “didn’t admit or deny the findings” in the regulatory matter, according to PlanAdviser. But the combined $3.75 million price tag, plus mandated security remediation, gives outside observers the clearest public accounting yet of what this breach actually cost the firm in direct settlement dollars alone, before legal fees, notification costs, and reputational damage are factored in.
Inside the August 2024 Breach
According to court filings and regulatory findings, an unauthorized third party accessed Fidelity’s computer network over a three-day window in August 2024 and pulled document images containing highly sensitive records: Social Security numbers, financial account numbers, driver’s license images, and in some cases medical information. Fidelity detected the suspicious activity and later determined the intrusion amounted to a targeted cybersecurity attack, not a broad opportunistic scrape.
The Massachusetts regulator’s findings point to the underlying cause: internal access controls that let users pull up documents that were not theirs to view. That is not an exotic zero-day. It is a permissions failure, the kind that shows up in access-control audits at almost any large document-management system if nobody is checking who can open what.
// What regulators say went wrong (simplified)
function getDocument(userId, documentId) {
const doc = documentStore.find(documentId);
return doc; // no ownership check before returning
}
// What an access-control review typically requires
function getDocument(userId, documentId) {
const doc = documentStore.find(documentId);
if (doc.ownerId !== userId && !hasDelegatedAccess(userId, doc)) {
throw new AccessDeniedError();
}
return doc;
}The pattern above is a generic illustration of the class of flaw regulators described, not a claim about Fidelity’s actual codebase. But it explains why the fix Fidelity agreed to was not a patch. It was hiring an independent cybersecurity consultant and certifying that data-protection systems have been rebuilt, a remediation structure regulators increasingly favor over a fine alone.
Who Got Hit: The Numbers Behind the Notification Gap
The headline number most outlets use is 77,099: the count of people whose files were confirmed compromised and who received formal breach notification. But the settlement paperwork covers a wider group. Roughly 86,000 additional individuals and joint accountholders, whose financial account and routing numbers were also exposed, were not formally notified at the time because they fell outside state-law notification triggers. They remain eligible for the class-action settlement, pushing the total class size to around 155,000 people, according to NBC Chicago.
The Massachusetts enforcement action adds a separate wrinkle: after learning of the breach, Fidelity also failed to notify a subset of affected residents, including beneficiaries, relatives, and minors connected to customer accounts. That failure, not just the original intrusion, became part of what the regulator cited when calculating the $1.25 million penalty.
That gap between “who was hacked” and “who was told” is becoming a recurring theme in 2026 breach enforcement. Regulators are treating notification failures as their own violation, separate from and additional to the original security lapse.
The $2.5 Million Class Action: How Payouts Work
Under the consumer settlement, eligible class members who filed a valid claim by the July 27, 2026 deadline, a date NTD confirmed in its May 2026 coverage, could receive a flat $100 cash payment, no documentation required, with California residents eligible for an additional $50 on top of that pro rata amount, according to Top Class Actions’ March 2026 reporting. Claimants who suffered documented out-of-pocket losses tied to the breach between August 17, 2024 and the claims deadline could seek reimbursement of up to $5,000, covering costs like credit monitoring fees, credit freezes, or direct financial fraud losses. All class members also became eligible for two years of identity theft protection and credit monitoring, including up to $1 million in fraud insurance per person, according to a March 2026 breakdown from the Plan Sponsor Council of America (PSCA), regardless of whether they filed a cash claim.
Because the $2.5 million fund is finite and payouts are pro-rated based on total claims filed, the actual per-person cash amount could swing either direction depending on how many people filed; CNBC Select estimated in its July 2026 coverage that cash payments were landing in the $100 to $150 range once pro-ration was applied, alongside reimbursements running up to the $5,000 documented-loss ceiling. That detail rarely makes the headline, but it matters for anyone trying to estimate what 155,000 potential claimants divided across a $2.5 million pool actually means in practice.
The Massachusetts Regulator’s $1.25 Million Rebuke
Where the class action is about compensating individuals, the Galvin settlement is about punishing the institution and forcing structural change. Fidelity Brokerage Services agreed to pay $1.25 million to the Commonwealth, hire an independent cybersecurity consultant, certify remediated controls, and identify and notify any Massachusetts residents connected to the breach who had not previously been informed. The action affected at least 2,768 Massachusetts customers and related individuals directly, according to WealthManagement.com, a fraction of the national total but enough to trigger a full state securities enforcement action.
This is a pattern state securities regulators have leaned on more since 2023: use consumer protection and securities-industry rules to force specific technical remediation, rather than let a company treat a fine as the cost of doing business. The independent-consultant requirement means Fidelity’s fixes get externally verified, not just self-certified.
Settlement Breakdown at a Glance
| Detail | Class-Action Settlement | Massachusetts Regulatory Settlement |
|---|---|---|
| Amount | $2.5 million | $1.25 million |
| Authority | U.S. District Court, Massachusetts | Secretary of the Commonwealth William Galvin |
| Basis | Consumer class-action litigation | State securities/data-protection enforcement |
| Final approval / announcement | Final approval hearing July 9, 2026 | Announced April 2026 |
| Claim deadline | July 27, 2026 | Not applicable (institutional penalty) |
| Individual payout | $100 flat, or up to $5,000 with documented losses | None (paid to the Commonwealth) |
| Non-monetary terms | Two years credit monitoring for class members | Independent cybersecurity consultant, certified remediation |
| Affected population cited | ~155,000 people/accounts nationally | At least 2,768 Massachusetts residents |
Why Financial Firms Keep Absorbing These Costs
Fidelity is not an isolated case in 2026. Financial and healthcare-adjacent firms have faced a wave of breach disclosures and settlements this year, each with its own scale and negotiated terms. The dollar figures vary enormously depending on record count, sector, and whether a regulator or a class of consumers is doing the negotiating, but the direction is consistent: incident response now routinely includes a multi-year settlement tail, not just a one-time notification cost.
What makes the Fidelity case distinct is the dual-track exposure. A single root cause, a permissions gap in a document system, produced both a securities-law enforcement action and a nationwide consumer class action running on separate timelines with separate lawyers, separate deadlines, and separate payout mechanics. Compliance teams increasingly have to model breach costs as two parallel legal tracks rather than one, because state regulators and class-action plaintiffs’ firms rarely coordinate.
How This Stacks Up Against Past Financial-Sector Breach Settlements
| Company | Breach Year | Records Affected | Settlement Amount | Settlement Year |
|---|---|---|---|---|
| Equifax | 2017 | ~147 million | Up to $700 million (FTC, CFPB, states) | 2019 |
| Capital One | 2019 | ~100 million | $190 million (class action) | 2021 |
| Fidelity Investments (class action) | 2024 | ~155,000 | $2.5 million | 2026 |
| Fidelity Brokerage Services (Massachusetts) | 2024 | ~2,768 (MA subset) | $1.25 million | 2026 |
The gap in scale between Equifax and Fidelity is enormous, but so is the gap in affected population, 147 million versus roughly 155,000. On a rough per-record basis, Fidelity’s combined $3.75 million works out to a smaller settlement pool overall but a comparable order of magnitude in dollars-per-affected-person once the flat $100 payments and credit monitoring costs are counted alongside the headline figure. That comparison is imperfect since Equifax’s fund included ongoing FTC and CFPB civil penalties layered on top of consumer compensation, but it is the closest apples-to-apples read available from public settlement data.
Market and Customer-Trust Impact
Fidelity manages retirement accounts, brokerage assets, and workplace benefits for tens of millions of Americans, which means even a breach confined to roughly 155,000 people lands with outsized reputational weight. Consumer trust research backs up why firms treat this as more than a legal line item. Statista found that 56% of U.S. respondents in a 2024 survey said they were “not likely at all” to trust a company that had experienced a data breach with their personal information, according to Statista. The same survey found that 76% of adults aged 45 to 54, a demographic heavily overlapping with retirement-account holders, said they were unlikely to keep sharing personal information with a company after a breach.
Security Magazine reported that 66% of consumers said in a 2024 survey that they would not trust a company with their data after a breach, according to Security Magazine. That erosion of trust does not always show up as account closures, switching brokerages is friction-heavy, but it shapes how customers respond to the next email, the next login prompt, or the next request for personal information from the same firm.
Older research from eMarketer offers a baseline for how normalized breaches have become. A 2022 report found that 33% of consumers globally had already been victims of a data breach at a company holding their personal information, yet 82% still said they trusted online digital service providers to protect their data, according to eMarketer. That gap between experienced harm and continued trust is exactly what regulators are now trying to close with mandatory remediation clauses rather than fines alone.
The Compliance Bill Keeps Growing
Direct settlement costs are only one line item. Fidelity’s obligations under the Massachusetts order include hiring and paying an independent cybersecurity consultant, a multi-year engagement, plus the internal engineering cost of rebuilding access controls across whatever document system allowed the original permissions gap. None of those figures are public, and reports have not disclosed them, so this analysis does not estimate a number. What is clear from the settlement terms themselves is that the $3.75 million in combined fines is a floor, not a ceiling, on what this breach costs the firm.
That structure, fine plus mandated third-party verification, has become the template state regulators reach for when a breach stems from an internal control failure rather than a novel external exploit. It shifts the incentive: a company weighing whether to under-invest in access-control audits now has to price in not just potential fine size but the near-certainty of an externally supervised rebuild if regulators find the root cause was preventable.
Historical Context: A Decade of Escalating Breach Accountability
The 2017 Equifax breach and its 2019 settlement set the modern template: a nine-figure fine, free credit monitoring for the entire affected population, and years of regulatory oversight. Capital One’s 2019 breach and 2021 settlement showed that even a cloud-configuration error, not a nation-state attack, could produce a $190 million consumer payout. Both cases involved breach sizes in the tens or hundreds of millions of records, dwarfing Fidelity’s roughly 155,000.
What has changed by 2026 is not the size of the biggest breaches, it is the consistency of enforcement at every scale. A firm no longer needs to expose 100 million records to face both a state regulatory action and a federal class action running in parallel. Fidelity’s case shows that a mid-sized breach, orders of magnitude smaller than Equifax or Capital One, now draws the same dual-track legal response that used to be reserved for the biggest incidents.
What Comes Next
- Expect more dual-track outcomes. State regulators and consumer class actions are increasingly pursuing the same breach independently, producing two settlements instead of one consolidated deal, as seen here.
- Notification-failure claims will keep showing up as separate violations. Regulators are treating “we didn’t tell affected people” as its own enforcement basis, distinct from the original intrusion.
- Independent-consultant mandates will become standard boilerplate in state-level breach settlements, giving regulators an ongoing verification mechanism instead of a one-time fine.
- Financial firms will face pressure to audit document-level access controls proactively, since permissions failures rather than exotic exploits are driving a growing share of 2026 enforcement actions.
- Claims administrators for the $2.5 million fund will likely report final per-claimant payout figures in the months after the July 27, 2026 deadline, once total claim volume is tallied.
What This Means for Fidelity Customers Now
For customers who already filed a claim before the July 27, 2026 deadline, the next step is watching for payout notices from the settlement administrator as the fund gets divided among all valid claims; MySanAntonio reported in July 2026 that Texas claimants specifically were bound by that same deadline and should expect a typical payout around $100 once pro-ration was applied. For those connected to a Fidelity account, including beneficiaries, relatives, or minors, who never received a breach notification and are unsure of their status, the settlement administrator can be reached to confirm eligibility. Beyond this specific case, the broader lesson for any brokerage or financial-services customer is that credit monitoring offered after a breach is worth activating immediately rather than letting the enrollment window lapse, since identity theft tied to exposed Social Security and account numbers can surface months or years after the original intrusion.
Frequently Asked Questions
Is the Fidelity data breach settlement $2.5 million or $1.25 million?
Both figures are real and refer to two different settlements tied to the same August 2024 breach. The $2.5 million is a federal class-action settlement for affected consumers. The $1.25 million is a separate penalty Fidelity Brokerage Services paid to Massachusetts regulators.
Can I still file a claim in the Fidelity data breach settlement?
The claims deadline for the $2.5 million class-action settlement was July 27, 2026. Anyone who missed that window should contact the settlement administrator directly to check whether late claims or eligibility exceptions apply.
What data was exposed in the 2024 Fidelity breach?
Reports indicate the compromised files contained names, Social Security numbers, financial account numbers, driver’s license images, and in some cases medical information tied to Fidelity customers and related individuals.
How many people were affected by the Fidelity breach?
Approximately 77,099 people received formal breach notification, while the total class covered by the settlement, including account holders whose data was exposed but who fell outside notification requirements, is roughly 155,000.
What caused the Fidelity data breach?
Massachusetts regulators found the breach was enabled by weaknesses in Fidelity’s internal cybersecurity controls that allowed users to access documents that were not their own, rather than an external system-wide exploit.
Did Fidelity admit wrongdoing in either settlement?
No. Fidelity did not admit or deny the regulatory findings in the Massachusetts settlement, which is standard practice in most negotiated breach settlements.
How does the Fidelity settlement compare to other major breach settlements?
It is far smaller in dollar terms than settlements like Equifax’s up-to-$700 million 2019 deal or Capital One’s $190 million 2021 settlement, but those breaches affected tens to hundreds of millions of records versus roughly 155,000 in Fidelity’s case.
What is Fidelity required to do beyond paying the settlements?
Under the Massachusetts settlement, Fidelity must hire an independent cybersecurity consultant, certify that its data-protection systems have been strengthened, and identify and notify any previously unnotified Massachusetts residents connected to the breach.
Related Coverage
- Hasbro Discloses Employee Data Breach: 436 SSNs Hit [2026]
- McKesson Confirms Breach: 284M Records, $55M Demand [2026]
- Berlin Confirms Data Theft After Rhysida Attack: 5.79TB [2026]
- ATF Hacked: Qilin Claims Breach, 885 Victims [2026]
- MAG Rejects Ransom Demand After 3-Airport Breach [2026]
