November 6, 2026
Updated: November 11, 2026
What the $2.5 million Fidelity Investments settlement covers, why claims are closed, how the payout math works, how to avoid fake settlement messages and what to do about exposed data.
Mohammed Khalil
The Fidelity data breach settlement is a $2.5 million class action deal over an August 2024 incident at Fidelity Investments (FMR LLC and Fidelity Brokerage Services). A federal judge in Massachusetts approved it on July 9, 2026, and the claim deadline passed on July 27, 2026, so new claims can't be filed. If you filed on time, payment comes only after the approval becomes final and the administrator allocates the fund. No payment date was published as of November 7, 2026. Treat any offer to help you file now with suspicion.
| Quick fact | Detail |
|---|---|
| Case | In re: Fidelity Investments Data Breach Litigation, No. 1:24-cv-12601-LTS, District of Massachusetts |
| Defendants | FMR LLC and Fidelity Brokerage Services LLC, both doing business as Fidelity Investments |
| Incident | August 17 to 19, 2024 |
| Settlement fund | $2,500,000 |
| Benefits offered | Up to $5,000 in documented losses, a no-proof cash payment estimated at $100, $50 for California residents, and credit monitoring |
| Claim deadline | July 27, 2026 (passed) |
| Final approval | July 9, 2026 |
| Payment date | Not published as of November 7, 2026 |
| Administrator | Simpluris, through the official settlement website |
This article is general information, not legal advice. DeepStrike is a cybersecurity company with no connection to Fidelity, the court, the lawyers or the settlement administrator. We did not test Fidelity's systems; everything here comes from public court, regulator and company documents listed at the end.
No. The official claim page now reads "The Claim Deadline has passed." The settlement FAQ set July 27, 2026 as the last day to file online or to postmark a paper form. What happens next depends on what you did before then.
| Your situation | What it means now |
|---|---|
| You filed a claim on time | You wait for the claim review and payment. Keep your confirmation and your contact details current with the administrator. |
| You got a notice but did not file | You get no payment. Unless you opted out, you are still bound by the settlement and its release of claims. |
| You opted out by June 26, 2026 | You get no payment and you keep any right to sue on your own. The court counted 11 valid opt-outs. |
| You think your claim was wrongly rejected | The agreement gives claimants with a deficient claim 21 days to fix it after the administrator's notice, so check your email and spam folder. |
If you aren't sure where you stand, contact the administrator using the details on the official contact page: info@FidelityDataSettlement.com or (833) 386-6470. If your rights are at stake, such as a large unreimbursed loss, ask a lawyer of your choosing.
One source of confusion: as of November 7, 2026, the official homepage and FAQ still said the court had yet to decide on approval. That wording predates the hearing. The Final Approval Order, posted on the site's own documents page, shows the judge approved the deal on July 9, 2026.
Several unrelated matters carry the Fidelity name, so check which one your letter refers to. This settlement covers only the August 2024 incident at Fidelity Investments.
| Name | What it is | Covered here? |
|---|---|---|
| Fidelity Investments (FMR LLC, Fidelity Brokerage Services) | Brokerage and investment firm; August 2024 document image incident | Yes |
| Fidelity Investments Life Insurance | Notified policyholders about a 2023 breach at its vendor, Infosys McCamish | No |
| Fidelity National Financial (FNF) | Title insurance company; November 2023 cyberattack | No |
| Fidelity National Information Services (FIS) | Separate payments and financial technology company | No |
Sources: the Fidelity Investments Life Insurance notice filed in Iowa, FNF's SEC filing and Wikipedia's FIS entry. We did not review the current status of any other case.
Between August 17 and 19, 2024, an unidentified third party obtained images of documents stored by Fidelity. Fidelity's October 2024 notice letter said the party used two recently established customer accounts and that the incident did not involve access to the recipient's own Fidelity accounts. The documents we reviewed do not identify who was responsible.
The most detailed public account is the Massachusetts Securities Division consent order, dated April 27, 2026. It says the documents could include Social Security numbers, financial account numbers, passport and driver's license numbers, insurance and medical information, dates of birth, and scanned images of active credit cards, passports and licenses. The information varied by person. Some affected people were not customers at all, including relatives and beneficiaries, and some were minors.
The numbers are easy to mix up because they count different groups:
Two separate outcomes followed. In the class action, Fidelity denied wrongdoing and agreed to pay $2.5 million. In the state case, Fidelity Brokerage Services agreed to a $1.25 million fine paid to Massachusetts, not to customers, while neither admitting nor denying the findings. A Fidelity spokesperson told InvestmentNews in April 2026 that the company had no evidence of resulting identity theft or fraud. Because the class action settled, the court did not decide who was right.
The court's definition has two groups of individuals in the United States:
So you could be in the class without receiving a 2024 breach letter, and possibly without being a customer if you received notice because your details appeared in someone else's documents. The judge, court staff, Fidelity's officers and directors, and people who opted out were excluded. California residents formed a subclass eligible for an extra payment.
Class notices went out starting April 27, 2026. The settlement site reported that some emails sent between April 27 and May 1 had blank name fields and said a corrective email fixed the problem.
Headlines focused on "up to $5,000," but that cap applies only to documented losses backed by proof. The benefit open to everyone without paperwork was the pro rata cash payment.
| Benefit | Who could claim | Amount | Proof |
|---|---|---|---|
| Documented losses | All class members | Up to $5,000 for losses from August 17, 2024 to July 27, 2026, if not already reimbursed | Receipts or statements; your own notes alone are not enough |
| Pro rata cash | All class members | Estimated at $100; can rise or fall | None |
| California payment | California subclass | $50; can be reduced | None |
| Credit monitoring | Class members who asked on the form | Two years of CyEx Financial Shield Complete with $1 million in fraud insurance | None |
The final amount comes from a fixed pot. Under the settlement agreement, costs are paid first, then documented losses, then credit monitoring, then California payments. Pro rata cash gets whatever remains, split among claimants.
The public filings let you estimate the pressure on that $100 figure. This is our illustrative math, not an official estimate:
Dividing $1,325,158 by 22,901 gives about $58 per claim. Even with no administration costs at all, the figure would be about $71. At $1,325,158, a full $100 payment would work only with about 13,250 claims or fewer. Documented losses, monitoring, California payments and later claims would reduce the share further; rejected claims or lower costs would raise it. The administrator will set the real number.
There is no published date. Under the agreement, the settlement becomes effective 30 days after the Final Approval Order if no appeal or motion that extends the time to appeal is filed. If there is an appeal, it becomes effective 15 days after that appeal ends in the settlement's favor. Payments then go out within 30 days after the administrator determines how the money is allocated, and that allocation has no fixed date.
The public court docket, last updated on October 27, 2026 when we checked, shows that the case was not entirely quiet after approval:
We saw no notice of appeal on that copy of the docket, but free mirrors can lag the court's own system, so this does not prove none exists. We also can't say whether these filings affect timing.
When payment comes, it will be electronic or, if you asked for one, by mailed check. Checks expire if not cashed within 90 days, and reissued checks are valid for 60 days. Credit monitoring codes are due in the same 30-day window. Leftover money goes to a second distribution if it would pay at least $5 each, and otherwise as state law requires or to the National Cybersecurity Alliance. None returns to Fidelity.
A real notice did go out in 2026, so an email about this settlement isn't automatically fake. But the claim window is closed, and that makes one rule simple: a message telling you to file a Fidelity claim now should not be trusted.
The FTC's guidance on refund and recovery scams describes the pattern. Scammers pose as agencies, law firms or other organizations, promise to recover money, then ask for an upfront fee or for your Social Security or account numbers. These are the steps we'd take, based on that guidance and Fidelity's own scam page:
Our guide to social engineering explains why breach news makes such a believable pretext.
Your risk does not end with the settlement, and these steps apply whether or not you filed. They come from the FTC's IdentityTheft.gov data breach page:
If someone has already used your information, report it at IdentityTheft.gov to get a recovery plan. Fidelity customers should also review the Customer Protection Guarantee, which covers losses from unauthorized activity in covered accounts on stated conditions, including prompt review and reporting. For a sense of how common this harm is, see our identity theft statistics.
The state order describes a flaw that any web developer would recognize. Fidelity's website let logged-in customers view images of their own documents. Behind the scenes, the site requested each image by a ten-digit ID. According to the order, the system did not properly confirm that the image belonged to the person asking.
The order says the attacker opened two brokerage accounts in July 2024 using other people's real identities. On August 17, it logged in and sent about 1,000 requests in an apparent trial run. Over August 18 and 19, it made about 23.7 million requests for randomly generated IDs, likely with a script. Most failed, but about 373,000 unique images came back, which works out to roughly 1.6% of calls by our calculation.
This is a textbook case of broken object level authorization, ranked first in the OWASP API Security Top 10. It is also known as an insecure direct object reference, or IDOR, and maps to CWE-862, missing authorization. The login was genuine, so authentication passed. The missing question was whether this user had the right to this document. A 2023 joint advisory from CISA, the NSA and Australia's ACSC warned that these flaws are common and can be abused at scale. Access control failures also lead the broader OWASP Top 10.
The order's most useful part is the specific gaps it lists, which Fidelity neither admitted nor denied. Each converts to a check your team can run. For sector context, see our guides to financial institution data breaches and financial services cybersecurity statistics.
| Finding in the order | Why it matters | What to verify |
|---|---|---|
| Service guide called for authorization controls from May 2019, but an API deployed in 2022 did not enforce them | A written standard protects nothing until each team implements it | Every API that returns an object has an owner and a release check for ownership enforcement |
| Pentest test accounts held no images, so testers could not exercise the view function | A test can only find what its environment lets it reach | Seed at least two test accounts with realistic objects, then try to reach account B's objects from account A |
| Attacker accounts used stolen identities, and image IDs were visible in browser developer tools | A valid login does not mean a trusted user, and hiding IDs alone is not the fix | Server-side checks hold for any logged-in user who knows or guesses an ID |
| Outside NIST-based assessments made general API recommendations, but none identified this flaw | Framework reviews do not prove object-level security | Pair assessments with hands-on authorization testing |
| Detection came from a DDoS system, which read the activity as a small attack | Volume alerts may misread data theft | Alert when one account requests many distinct objects or triggers many denials |
| Some Massachusetts residents, including relatives and minors, were not notified | Documents name more people than the account holder | Breach scoping covers everyone named in the data, not just customers |
Three further points are our analysis rather than the order's:
The public price tag so far is $3.75 million across the settlement and the fine, before Fidelity's own legal, response and remediation costs. See our breakdown of the cost of a data breach and wider data breach statistics.
Automated scanners often miss this class of flaw, because each individual response looks normal. It takes a tester who holds two or more accounts and knows what each should be able to reach. In a test environment you own or are authorized to test, the tester requests one account's objects with another account's session, across every endpoint and method, then repeats the test after the fix. Our guide to API penetration testing explains how to scope this work.
Yes. It was approved on July 9, 2026 in In re: Fidelity Investments Data Breach Litigation in federal court in Massachusetts. The official site is fidelitydatasettlement.com, run by the administrator, Simpluris.
Nobody can say yet. The no-proof cash payment was estimated at $100, but it depends on the money left after costs and other benefits and on the number of claims. Our illustrative math from public filings points to less than $100.
No date was published as of November 7, 2026. Payment follows the settlement's effective date and the administrator's allocation, and the docket still showed activity in late October.
No. Fidelity denied wrongdoing in the class action and neither admitted nor denied the findings in the Massachusetts order. The court made no ruling on who was right.
Fidelity's notice letter said the incident did not involve access to the recipient's Fidelity accounts. The data was taken from document images, and that data can still be misused elsewhere, so the protection steps above still apply.
If you were affected, freeze your credit, review your reports and be careful with any message about this settlement. If you run an application that serves customer documents, ask a narrower question: has anyone tried to fetch one customer's records while logged in as another, in an environment with real-looking data?
DeepStrike's web application penetration testing includes security checks from multiple users' perspectives, and our broader penetration testing services cover applications, cloud and infrastructure with validated findings and fix recommendations. Testing reduces risk but cannot guarantee that no flaw remains. Talk to our team if you'd like to scope an authorization review.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
