What Is the Fidelity Investments Data Breach Lawsuit?
The Fidelity Investments data breach lawsuit is a federal class action alleging Fidelity failed to reasonably safeguard customer data during an August 2024 breach, formally captioned In re: Fidelity Investments Data Breach Litigation, Lead Case No. 1:24-cv-12601-LTS, pending in the U.S. District Court for the District of Massachusetts.
Named plaintiffs Richard Mason, Alexander Elterman, Ratiek Lowery, Robert Wilbert, and John Nixon filed a Consolidated Class Action Complaint on February 10, 2025, after several individual actions were combined into one case before U.S. District Judge Leo T. Sorokin.
FMR LLC and Fidelity Brokerage Services LLC, both doing business as Fidelity Investments, are the named defendants. Fidelity denies any wrongdoing, and no court has ruled on the merits of the underlying allegations; the case was resolved through a negotiated settlement instead.
“On February 10, 2025, after having filed separate actions, the Class Representatives, on behalf of themselves and all others similarly situated, filed a Consolidated Class Action Complaint (the “Action”) in the United States District Court for the District of Massachusetts, captioned In re Fidelity Investments Data Breach Litigation, Lead Case No. 1:24-cv-12601-LTS. The Class Representatives asserted claims against Defendants for negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, unjust enrichment, and violations of state consumer-protection and privacy statutes.”
Source: Settlement Agreement and Release, In re Fidelity Investments Data Breach Litigation, No. 1:24-cv-12601-LTS (D. Mass.), Document 61-1, filed March 10, 2026
Why Are People Filing Fidelity Investments Data Breach Lawsuits?
People filed the Fidelity Investments data breach lawsuit because plaintiffs allege Fidelity's own security failures let an unauthorized third party access sensitive customer data between August 17 and August 19, 2024. A subsequent forensic investigation confirmed the intrusion and the categories of data it reached.
According to Fidelity's own notifications and the settlement agreement, the unauthorized party gained access through newly established customer accounts and used that access to reach an internal database containing document images and account records. The exposed information reportedly included names, Social Security numbers, driver's license numbers, and financial account and routing numbers for tens of thousands of customers.
The consolidated complaint pleads negligence, breach of implied contract, breach of the covenant of good faith and fair dealing, unjust enrichment, and violations of the Massachusetts Consumer Protection Act, the California Consumer Privacy Act, the California Customer Records Act, the California Unfair Competition Law, and New York General Business Law Section 349, arguing Fidelity's data-security practices, not any single bad actor, are what exposed customers to harm.
What Injuries Are Included in the Fidelity Investments Data Breach Lawsuit?
The Fidelity Investments data breach lawsuit alleges harms tied to identity-theft risk and financial exposure rather than physical injury. Each harm type below carries its own plain-language definition before the specific allegation.
Identity Theft and Fraud Risk
Identity theft is the unauthorized use of someone's personal identifying information, such as a Social Security number or driver's license number, generally to open accounts, file claims, or make purchases in that person's name.
The complaint alleges that exposing Social Security numbers and driver's license information left class members at heightened, ongoing risk of identity theft and fraud, even absent proof that a specific person's information was already misused. The settlement's reimbursement benefit and two years of identity-theft monitoring are both structured around this risk rather than requiring proof that fraud has already occurred.
Unauthorized Access to Financial Account Information
Financial account exposure refers to a third party gaining access to bank or brokerage account numbers and routing numbers without the accountholder's authorization.
Beyond the roughly 77,099 individuals who received direct notice, the settlement agreement separately identifies about 86,000 additional individuals or joint accountholders whose financial account and routing numbers were exposed, even though they were not all subject to state-law notification requirements. Both groups are included in the settlement class.
Out-of-Pocket Losses and Lost Time
Out-of-pocket losses are direct monetary costs a person incurs responding to a data breach, such as credit-monitoring fees, replacement identification costs, or time spent resolving fraudulent charges.
Plaintiffs allege class members spent money and time protecting themselves after the breach, including fees for credit reports, credit freezes, and identification replacement. The settlement's documented-loss benefit reimburses up to $5,000 per class member for expenses of this kind incurred between August 17, 2024, and July 27, 2026.
Who Qualifies for the Fidelity Investments Data Breach Lawsuit?
You may qualify if:
- You received notice from Fidelity about the August 2024 Data Security Incident under applicable state or foreign law before the settlement's notice deadline
- Your financial account number and routing number were exposed in the Data Security Incident, even if you did not receive a direct notice letter
You may not qualify if:
- You are the judge assigned to the case, an immediate family member of the judge, or a member of the court's staff
- You are an officer or director of Fidelity, or you validly and timely excluded yourself (opted out) from the settlement class before the June 26, 2026 deadline
The claims deadline for this settlement, July 27, 2026, has already passed. This eligibility summary describes the settlement class definition for reference; only the settlement administrator's own records can confirm whether a specific claim was timely filed.
What Is the Current Status of the Fidelity Investments Data Breach MDL?
The current status of the Fidelity Investments data breach lawsuit is fully resolved: the court granted final approval and entered judgment, and the claims window has since closed.
In re: Fidelity Investments Data Breach Litigation, No. 1:24-cv-12601-LTS
U.S. District Judge Leo T. Sorokin granted preliminary approval to the $2.5 million settlement on March 11, 2026, after the parties reached an agreement in principle following an October 23, 2025 mediation session before Hon. Wayne Andersen of JAMS. The court entered final approval and judgment on July 9, 2026, and the deadline for class members to submit a claim, July 27, 2026, has already passed.
| Proceeding Type | Federal class action, consolidated complaint |
| Court | U.S. District Court for the District of Massachusetts |
| Judge | Leo T. Sorokin |
| Complaint Filed | February 10, 2025 |
| Defendants | FMR LLC and Fidelity Brokerage Services LLC (d/b/a Fidelity Investments) |
| Settlement Status | Final approval and judgment entered July 9, 2026; claims deadline passed July 27, 2026 |
Massachusetts Secretary of the Commonwealth Enforcement Action
Separately from the federal class settlement, Fidelity agreed to pay a $1.25 million fine to resolve allegations by Massachusetts Secretary of the Commonwealth William Galvin that it failed to reasonably protect client data in the same 2024 incident. That state regulatory settlement required Fidelity to hire an independent cybersecurity consultant and identify every affected Massachusetts resident, and it does not pay money to individual class members the way the federal settlement does.
| Proceeding Type | State regulatory enforcement action |
| Regulator | Massachusetts Secretary of the Commonwealth (Securities Division) |
| Fine Amount | $1.25 million |
| Relationship to Class Action | Separate proceeding over the same incident; does not pay individual class members |
How Much Will I Get From the Fidelity Investments Data Breach Settlement?
The Fidelity Investments settlement fund totals $2.5 million, and eligible class members could claim a pro rata cash payment of about $100, up to $5,000 in documented losses, and an additional $50 California-only payment, though the claims deadline has already passed. The pro rata amount is an estimate that could be higher or lower depending on the total number of valid claims filed.
$2.5 million is the court-approved settlement fund total, a checkable, definitive figure. The $100 pro rata estimate, the up-to-$5,000 documented-loss reimbursement, and the $50 California Consumer Privacy Act payment are the settlement's own published benefit amounts, not a guarantee of what any individual claimant actually received, since actual payouts depend on the total number of valid claims.
All class members could also enroll in two years of CyEx Financial Shield Complete identity-theft protection and credit monitoring, which includes $1 million of financial fraud insurance, regardless of whether they claimed a cash payment.
Class Counsel asked the court to approve up to one-third of the settlement fund as attorneys' fees, plus up to $45,000 in litigation costs and $2,500 service awards for each of the five class representatives, all paid from the $2.5 million fund before other benefits are distributed.
Fidelity Investments Data Breach Lawsuit Updates and Case Status
Here is the current status of the Fidelity Investments data breach lawsuit, updated with new filings, rulings, and settlement developments as they're confirmed.
Fidelity Investments Data Breach Lawsuit Timeline
Claims Deadline Passes for the Fidelity Data Breach Settlement
The deadline for class members to submit a Claim Form in the Fidelity Investments data breach settlement passed on July 27, 2026, closing the window for new claims under the $2.5 million fund.
Court Grants Final Approval and Enters Judgment
The U.S. District Court for the District of Massachusetts held a Final Approval Hearing and entered judgment on July 9, 2026, formally approving the $2.5 million settlement in In re: Fidelity Investments Data Breach Litigation.
Massachusetts Fines Fidelity $1.25 Million Over the Same Breach
Massachusetts Secretary of the Commonwealth William Galvin announced a $1.25 million settlement with Fidelity resolving state allegations that it failed to reasonably protect client data in the August 2024 incident, a separate proceeding from the federal class settlement.
Judge Sorokin Grants Preliminary Approval
U.S. District Judge Leo T. Sorokin granted preliminary approval to the $2.5 million Fidelity Investments data breach settlement on March 11, 2026, finding the proposed nationwide class presented common legal and factual questions suited to class-wide resolution.
Parties Mediate Before Reaching a Settlement
Counsel for the parties participated in a full-day mediation session before Hon. Wayne Andersen of JAMS on October 23, 2025, and reached an agreement in principle in the days that followed, after the court had stayed litigation on August 25, 2025 to allow settlement talks.
Fidelity Moves to Dismiss the Consolidated Complaint
Fidelity filed a Motion to Dismiss the plaintiffs' claims in their entirety on April 11, 2025; plaintiffs opposed the motion on June 10, 2025, and Fidelity filed its reply on July 1, 2025, shortly before the parties began settlement discussions.
Plaintiffs File the Consolidated Class Action Complaint
Named plaintiffs Richard Mason, Alexander Elterman, Ratiek Lowery, Robert Wilbert, and John Nixon filed a Consolidated Class Action Complaint on February 10, 2025, combining several individually filed actions into the case now captioned In re: Fidelity Investments Data Breach Litigation.
Fidelity Detects and Stops the Data Security Incident
Fidelity detected unauthorized access to its computer network on August 19, 2024, terminated the access, and began a forensic investigation into an intrusion that had started on August 17, 2024 and affected tens of thousands of customers.
How to File a Fidelity Investments Data Breach Lawsuit
The 4 steps below explain how to file a Fidelity Investments Data Breach lawsuit.
- Check whether you received a notice from Fidelity: Individuals who received direct notice of the August 2024 Data Security Incident, or whose financial account and routing number were exposed, were part of the settlement class.
- Review the settlement website for your claim status: The official settlement site, fidelitydatasettlement.com, lists claim status and benefit information for class members who filed before the deadline.
- Preserve records of any related losses: Anyone who believes the breach caused them identity theft or fraud losses should keep bank statements, credit reports, and receipts, since a new, separate legal claim would require this documentation independent of the closed settlement.
- Consult a qualified attorney about options outside this settlement: Only a qualified attorney reviewing your specific circumstances can advise whether any option remains available now that this settlement's claims deadline has passed.
Fidelity Investments Data Breach Lawsuit is no longer accepting new claims. The court entered final approval and judgment on July 9, 2026, and the claims deadline of July 27, 2026 has already passed, so no new claims can be submitted in this settlement.
What Did Fidelity Allegedly Know About Its Data Security Practices?
Plaintiffs allege Fidelity's own data-security practices were inadequate to protect the sensitive customer information it held, allowing an unauthorized third party to exploit newly created customer accounts to reach an internal database of document images and account records. Fidelity denies each and every claim and contention alleged against it and denies that the action could properly be litigated as a class action, while agreeing to the settlement to avoid the cost and uncertainty of continued litigation.
Separately from the class litigation, the Massachusetts Secretary of the Commonwealth investigated the same incident and reached its own $1.25 million enforcement settlement with Fidelity, requiring the company to hire an independent cybersecurity consultant and identify every affected Massachusetts resident. That regulatory settlement is a distinct proceeding from the federal class action described above; it resolves a state agency's claims, not the private class members' claims, and it does not pay compensation to individual customers.
How Does This Case Compare to Other Fidelity Legal Matters?
Fidelity Investments and its FMR LLC parent have faced other legally distinct matters over the years that share the company's name but are not part of the 2024 data breach litigation described on this page. Each is listed below for disambiguation only.
| Matter | What It Involves | Relationship to This Case |
|---|---|---|
| Massachusetts Secretary of the Commonwealth fine | A $1.25 million state regulatory fine over the same August 2024 breach | Same underlying incident, but a separate regulatory proceeding, not part of the class settlement |
| Fidelity National Financial (unrelated company) | A separate title-insurance company that also uses the Fidelity name but has no corporate relationship to FMR LLC | Name similarity only; any litigation involving Fidelity National Financial is legally unrelated to this case |
Frequently Asked Questions
What is the Fidelity Investments data breach lawsuit about?
The Fidelity Investments data breach lawsuit is a federal class action alleging Fidelity failed to reasonably secure customer data during an August 2024 breach that exposed names, Social Security numbers, driver's license information, and financial account and routing numbers for tens of thousands of customers.
Is the Fidelity Investments lawsuit a class action?
Yes, the Fidelity Investments lawsuit is a consolidated federal class action, captioned In re: Fidelity Investments Data Breach Litigation, filed on behalf of individuals notified of the breach and additional accountholders whose financial account and routing numbers were exposed.
Has the Fidelity Investments data breach lawsuit settled?
Yes, the Fidelity Investments data breach lawsuit settled for $2.5 million, with the court granting final approval and entering judgment on July 9, 2026, after the parties reached the agreement through mediation in late 2025.
Can I still file a claim in the Fidelity settlement?
No, filing a claim in the Fidelity settlement is no longer possible, because the claims deadline of July 27, 2026 has already passed, closing the window for new submissions to the $2.5 million fund.
How much did the Fidelity data breach settlement pay?
The Fidelity data breach settlement paid eligible class members an estimated $100 pro rata cash payment, up to $5,000 for documented losses, an additional $50 for California residents, and two years of identity-theft protection, all drawn from the $2.5 million settlement fund.
Is the Massachusetts fine the same as the class action settlement?
No, the Massachusetts fine is not the same as the class action settlement. The $1.25 million fine resolved a separate enforcement action brought by the Massachusetts Secretary of the Commonwealth over the same breach, while the $2.5 million settlement resolved the private class action and is the only one of the two that paid money to individual customers.