Morgan Stanley

Disclosed Jul 10, 20206 years ago14,256,250 affectedConfirmed

What is known

People affected	14,256,250 (as reported by the organization)
Disclosed	Jul 10, 2020
Discovered	May 20, 2021
Happened	Jan 20, 2021
Attack	Hacking
Data exposed	Names, Social Security numbers
Sector	Tech · US
Status	Confirmed

Source	Kind
California Attorney General breach notice: Morgan Stanleyoag.ca.gov · Official notice	Official notice
Washington Attorney General breach notice: Morgan Stanleyatg.wa.gov · Official notice	Official notice
Oregon DOJ breach notice: Morgan Stanleyjustice.oregon.gov · Official notice	Official notice
Indiana Attorney General 2021 data breach report: Morgan Stanleyin.gov · Official notice	Official notice
Indiana Attorney General 2020 data breach report: Morgan Stanleyin.gov · Official notice	Official notice
Maine Attorney General breach notice archive: Morgan Stanleymaine.gov · Official notice	Official notice

Where	Filed	People
California AGresidents of CA	Jul 10, 2020
Washington AGresidents of WA	Jul 10, 2020	401,246
Oregon DOJresidents of OR	Jul 10, 2020	209,881
Indiana AGresidents of IN	Jul 10, 2020	154,619
Indiana AGresidents of IN	Jul 10, 2020	450
Maine AGresidents of ME	Jul 10, 2020	490
California AGresidents of CA	Jul 2, 2021
Washington AGresidents of WA	Jul 2, 2021	2,080
Oregon DOJresidents of OR	Jul 2, 2021	33,443
Indiana AGresidents of IN	Jul 2, 2021	395

Breach	Disclosed	Attack	Sector	Status	Affected
Auctioned devices with unwiped customer data; USD 6.5M multistate settlementNov 16, 20232 years agoLost or stolen device	Nov 16, 20232 years ago	Lost or stolen device	Finance	Settled	Unknown
SEC fines Morgan Stanley $35M over lost drives holding data of 15M customersSep 20, 20224 years agoVendor breach	Sep 20, 20224 years ago	Vendor breach	Finance	Settled	15M

History of this record

2026-09-25 · data_types: [] to ["names","ssn"] · backfill source
2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdf · backfill source
2026-09-25 · records: 33443 to 14256250 · backfill source
2026-09-25 · records_basis: empty to organization · backfill source
2026-09-25 · records: empty to 33443 · backfill source
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · discovered: empty to 2021-05-20 · backfill source
2026-09-25 · disclosed: 2021-07-02 to 2020-07-10 · backfill source
2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.