Morgan Stanley Agrees to Pay $6.5 Million Fine in Agreement with AGs Over Compromised Customer Information

By Denny Jacob

Morgan Stanley agreed to pay a fine of $6.5 million following an agreement with a coalition of attorneys general over the financial services provider compromising millions of customers' personal information.

Morgan Stanley, doing business as Morgan Stanley Smith Barney LLC, failed to decommission its computers and erase unencrypted data in certain computer devices that were later auctioned while still containing consumers' personal information, according to New York Attorney General Letitia James.

One incident involved Morgan Stanley hiring a moving company with no experience in data destruction services to decommission thousands of hard drives and servers containing sensitive information, James said. The company was only made aware of the problem when a purchaser from an auction discovered the data and called.

In a second incident, Morgan Stanley found that 42 servers, all potentially containing unencrypted customer information, were missing during a decommissioning process, according to the New York attorney general.

In addition to the fine, Morgan Stanley agreed to adopt a series of steps aimed at strengthening its data security measures including encrypting all personal information, whether stored or transmitted, between documents, databases and elsewhere; maintaining an incident response plan that documents incidents and responses; and maintaining a vendor risk assessment team, among other provisions.

"We have previously notified all potentially impacted clients regarding these matters, which occurred several years ago, and are pleased to have resolved this related investigation," said a Morgan Stanley spokesperson.

Joining James in the agreement are the attorneys general of Connecticut, Florida, Indiana, New Jersey and Vermont.

Write to Denny Jacob at [e-mail]

(END) Dow Jones Newswires

November 16, 2023 12:33 ET (17:33 GMT)

Copyright (c) 2023 Dow Jones & Company, Inc.