Connect with us

Hi, what are you looking for?



Morgan Stanley Fined $6.5 Million for Exposing Customer Information

Morgan Stanley agrees to pay $6.5 million for exposing personal information through negligent data-security practices.

Morgan Stanley has agreed to a $6.5 million settlement over insecurely disposing of hardware containing unencrypted personal information.

Through negligent internal data security practices, the multinational investment bank and financial services company potentially exposed the personal information of millions of customers, the Florida Attorney General’s Office says.

An investigation into the company uncovered that it did not properly erase unencrypted personal information stored on devices that were being decommissioned.

Specifically, when looking to decommission thousands of hard drives containing sensitive consumer information, Morgan Stanley hired “a moving company with no experience in data-destruction services” and failed to monitor its actions.

The moving company, the AG says, sold the computer equipment at internet auctions without Morgan Stanley’s knowledge. Ultimately, a downstream purchaser found the data and contacted Morgan Stanley.

During another decommissioning process, the financial services company discovered 42 missing servers potentially containing unencrypted customer information. The issue, the investigation discovered, was due to “a manufacturer flaw in the encryption software”.

The investigation also found that the financial services company failed to implement proper vendor controls and asset inventories, which could have prevented the data exposure.

As part of the agreement (PDF), in addition to paying $6.5 million to the states of Florida, Connecticut, Indiana, New Jersey, New York, and Vermont, Morgan Stanley was ordered to improve the security of personal information.

Advertisement. Scroll to continue reading.

The company was ordered to encrypt data both at rest and in transit, implement a data collection, use, retention, and disposal policy, implement tools to track hardware containing personal information, and maintain an information security program, an incident response plan, and a vendor risk assessment team.

Related: Equifax Fined $13.5 Million Over 2017 Data Breach

Related: US States Announce $16M Settlement With Experian, T-Mobile Over Data Breaches

Related: Zoom Agrees to Step Up Security After New York Probe

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...


The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often...

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.

Data Breaches

KFC and Taco Bell parent company Yum Brands says personal information was compromised in a January 2023 ransomware attack.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Data Breaches

AT&T is notifying millions of wireless customers that their CPNI was compromised in a data breach at a third-party vendor.