Morgan Stanley to pay 6 states $6.5M for failing to protect customer data
Morgan Stanley Smith Barney agreed Thursday to pay six states $6.5 million to settle charges that it failed to protect customers’ personal information while shutting down two data centers in 2016.
The problem occurred when computer devices were decommissioned and resold following the closure of the data centers. Morgan Stanley contracted with a vendor to remove data from the devices. But the vendor subcontracted some of the work to an unauthorized vendor and some customer information was left on the computers, according to an agreement released by New York Attorney General Letitia James.
A second incident involved a software flaw that could have allowed unencrypted customer data to remain on devices that Morgan Stanley could not locate after they were decommissioned. The vulnerabilities involved the disposal of computer hardware rather than an external breach.
Approximately 15 million clients’ details were exposed over a five-year period beginning in 2015, Bloomberg News previously reported.
An investigation by James and the other state attorneys general “determined that Morgan Stanley failed to maintain adequate vendor controls and hardware inventories, and that had these controls been in place, the data incidents could have been prevented,” the New York agreement states.
The firm notified the attorneys general on July 10, 2020, about the potential vulnerability of the client data. The settlement with New York, Connecticut, New Jersey, Vermont, Indiana and Florida concluded an ongoing investigation. The firm reached a $35 million settlement with the Securities and Exchange Commission last year over the same charges.
“No one should have their personal information auctioned off without their knowledge because a company
Read more on investmentnews.com
