Fidelity's $5,000-per-customer cap is mostly illusion — $3.75M for 373,000 stolen images, settled the same month Reg S-P went live

The press coverage has led with \"up to $5,000 per customer,\" but the pool math is structural. The class-action fund totals $2.5 million; at the maximum individual payout of $5,000, that money covers exactly 500 of the ~163,000 eligible accounts — the 77,099 customers Fidelity notified plus the ~86,000 joint-account holders whose routing and account numbers were exposed but who were not directly notified under state law. Everyone else gets a pro-rata cash payment expected to land near $100, plus a California-only $50 bonus under the CCPA, plus two years of identity-theft protection with up to $1 million in fraud insurance.

Set against Fidelity's reported $16.4 trillion in assets under administration as of Q2 2025, the combined $3.75 million cash hit is roughly two-thousandths of one basis point of AUA. The settlement numbers are not the story; they are the public-facing residue of a much larger governance and remediation bill.

Between August 17 and August 19, 2024, an unauthorized third party used two compromised Fidelity customer accounts to access images stored in the firm's internal Document Image Repository — the system Fidelity uses to store statements, tax forms, and other account documents. The threat actor exploited a weakness in the document-identification flow that let one customer's session retrieve other customers' images. Fidelity detected the activity on August 19 and shut down the two accounts the same day, but not before roughly 373,000 unique images and 23.7 million API calls had cycled through the system.

The parallel consent order from the Massachusetts Securities Division is the more important document for investors. Docket No. E-2024-0373 charges Fidelity Brokerage Services LLC with failing to enforce \"appropriate authorization controls\" on its Document Image Repository, and failing to provide breach notice to certain Massachusetts residents. The $1.25 million administrative fine is small, but the operational requirements are not.

The SEC's amendments to Regulation S-P became effective August 2, 2024 — two weeks before the Fidelity breach. Larger firms (>$1.5 billion AUM) had a December 3, 2025 compliance date; small firms were given until June 3, 2026. The Fidelity final-approval hearing on July 9, 2026 landed just 36 days after the small-firm deadline, and the claim deadline of July 27 lands four weeks inside the new regime.

Fidelity is not an isolated incident. In the 14 months since its breach disclosure, at least two other large wealth-management platforms have reported account-access compromises with similar mechanics — adversaries using compromised credentials to retrieve customer documents or execute unauthorized transactions.

The pattern is consistent: a third party uses a foothold inside the platform — a customer account at Fidelity, an advisor account at LPL, a single compromised email at Ameriprise — to either retrieve documents or execute trades. None of the three involved direct theft of customer funds; all three exposed personal information that plaintiffs' lawyers can convert into a class action under state privacy statutes.

The headline settlement of $3.75 million is noise relative to the AUA base of any major custodian. The investable signal is governance overhead and the new regulatory floor. For publicly traded peers, three threads matter.