Million-Dollar Fine for Bank of America and EY: When Data Privacy Becomes a Farce

The shockwave that rippled through the financial industry couldn’t have been louder: Ernst & Young and Bank of America are jointly ordered to pay $2.5 million — for failing to adequately protect their customers in the worst data breach stemming from the MOVEit hack. A penalty many see as a mere slap on the wrist. While EY and Bank of America now have lighter pockets, the deeper question lingers: Who, exactly, is protecting us — the customers?
MOVEit: The Ticking Time Bomb in Our Digital World
Imagine someone stealing not just your wallet, but your entire identity. That’s precisely what the MOVEit hack felt like for millions of victims. In May 2023, hackers exploited a vulnerability in MOVEit software — a tool marketed for secure file transfers. Suddenly, it wasn’t just emails and invoices at risk; Social Security numbers, bank details, everything that makes a person financially and personally vulnerable, was exposed.
And the victims? They’re waving hello to Bank of America and EY. Both companies used MOVEit, both should have known the stakes. Instead of hardening their systems in time, they waited — until it was too late.
The Big Question: Why Does Data Protection Keep Failing?
EY, serving as Bank of America’s auditor, is accused of not taking MOVEit’s risks seriously enough. But this isn’t an isolated incident. The bank itself, one of the largest in the world, had security measures in place — yet apparently not enough. Experts can only shake their heads: too many companies rely on outdated systems, delay updates, or ignore warning signs.
The MOVEit hack could have been prevented. A swift patch, a stronger firewall, a l



ittle more vigilance — and millions wouldn’t still be scrambling to reclaim their identities today.
$2.5 Million: A Symbolic Kick in the Gut for the Corporations?
For EY and Bank of America, the fine is annoying but manageable. For customers? A bad joke. No compensation, no restitution — just the hollow promise that “everything will be better now.” Sound familiar? In the financial world, such arrangements are routine. Corporations pay, carry on as before, and consumers foot the bill.
Yet one truth should be clear: data protection is not a luxury, but a fundamental duty. If banks and auditors can’t secure standard software, how can we, as customers, ever feel safe?
Why Regulators Took So Long — and Who Is Really Responsible
It took over a year for authorities to finally act. A full year during which criminals freely stole and misused data. Why? Perhaps regulators are overwhelmed. Perhaps corporations had too much time to wiggle out. Or perhaps the justice system simply moves too slowly.
But one thing is certain: this delay has real consequences. For each and every one of us.
The Only Lesson from This Disaster? We Must Demand More.
This case isn’t an exception — it’s a wake-up call. The financial sector, along with policymakers and legislators, must finally grasp: data protection can’t be a marketing slogan. It must be lived — through rigorous oversight, severe penalties, and a zero-tolerance policy.
Because one thing is clear: the next major hack will happen. The question is only whether we’ll be better prepared this time. Or whether we’ll once again accept that corporations neglect their duties — while we pay the price.