Morgan Stanley settles for $6.5 million over data breach

Investing.com

Published Nov 17, 2023 02:00

Morgan Stanley settles for $6.5 million over data breach

NEW YORK - Morgan Stanley has agreed to a $6.5 million settlement with a group of state attorneys general, led by New York's Letitia James, due to the investment firm's negligence in properly decommissioning computers that contained unencrypted customer data. The oversight led to private consumer information being auctioned off and potentially exposed millions of customers, including approximately 1.1 million in New York.

The issue was uncovered when a purchaser of auctioned equipment found the sensitive data. An investigation revealed that Morgan Stanley hired an inexperienced moving company for the decommissioning of hard drives and servers, which resulted in the equipment being sold without erasing the private information. Additionally, during another decommissioning process, the firm discovered that 42 servers possibly containing unencrypted customer data were missing, attributed to a software encryption flaw.

As part of the settlement announced today, Morgan Stanley will implement several measures to strengthen its data security:

  • Establish a comprehensive information security program.
  • Create an incident response plan.
  • Draft a written policy for managing personal information.
  • Encrypt all personal data.
  • Track hardware locations storing personal information.
  • Assess vendor compliance with Morgan Stanley’s data security standards through a vendor risk assessment team.

New York will receive over $1.65 million from the settlement funds. The case was managed by the Bureau of Internet and Technology within the Division for Economic Justice, reflecting Attorney General James' commitment to safeguarding personal information and holding entities accountable for inadequate data protection practices.

In her ongoing efforts to protect consumer data, Attorney General James has previously secured significant settlements from various organizations for failing to prevent data breaches, including Blackbaud (NASDAQ:BLKB), Marymount Manhattan College, a medical management company, SHEIN and Zoetop, Wegmans, and Sports Warehouse.

Morgan Stanley's pledge to enhance its security measures includes establishing a robust incident response plan and a vendor risk assessment team as well as encrypting all personal data.

This article was generated with the support of AI and reviewed by an editor. For more information see our T&C.

Get The App
Join the millions of people who stay on top of global financial markets with Investing.com.
Download Now

Trading in financial instruments and/or cryptocurrencies involves high risks including the risk of losing some, or all, of your investment amount, and may not be suitable for all investors. Prices of cryptocurrencies are extremely volatile and may be affected by external factors such as financial, regulatory or political events. Trading on margin increases the financial risks.
Before deciding to trade in financial instrument or cryptocurrencies you should be fully informed of the risks and costs associated with trading the financial markets, carefully consider your investment objectives, level of experience, and risk appetite, and seek professional advice where needed.
Fusion Media would like to remind you that the data contained in this website is not necessarily real-time nor accurate. The data and prices on the website are not necessarily provided by any market or exchange, but may be provided by market makers, and so prices may not be accurate and may differ from the actual price at any given market, meaning prices are indicative and not appropriate for trading purposes. Fusion Media and any provider of the data contained in this website will not accept liability for any loss or damage as a result of your trading, or your reliance on the information contained within this website.
It is prohibited to use, store, reproduce, display, modify, transmit or distribute the data contained in this website without the explicit prior written permission of Fusion Media and/or the data provider. All intellectual property rights are reserved by the providers and/or the exchange providing the data contained in this website.
Fusion Media may be compensated by the advertisers that appear on the website, based on your interaction with the advertisements or advertisers.

Sign out
Are you sure you want to sign out?
NoYes
CancelYes
Saving Changes