Morgan Stanley to Pay 6 States $6.5M Over Client Data Security

Morgan Stanley, according to James, “hired a moving company with no experience in data destruction services to decommission thousands of hard drives and servers containing sensitive information of millions of its customers.”

Morgan Stanley then “failed to properly monitor the moving company’s work, and its computer equipment, some of which still contained private consumer information, was then sold at auction.”

Morgan Stanley was only made aware of the problem when a purchaser discovered the data and called the company, according to James’ office.

In a second incident, Morgan Stanley discovered during a decommissioning process that 42 servers, all potentially containing unencrypted customer information, were missing.

“During this process, the company learned that the local devices being decommissioned may have contained unencrypted data due to a manufacturer flaw in the encryption software,” the order states.

The multistate investigation found that Morgan Stanley “failed to maintain adequate vendor controls and hardware inventories, and that had these controls been in place, both data security events could have been prevented,” James said.

Morgan Stanley said in a statement that the firm has “previously notified all potentially impacted clients regarding these matters, which occurred several years ago, and are pleased to have resolved this related investigation.”