Breachesby GlyphMorgan Stanley
Disclosed Sep 20, 202215,000,000 affectedSettled
SEC fines Morgan Stanley $35M over lost drives holding data of 15M customers
The SEC found that from 2015 Morgan Stanley's wealth unit hired a moving company without data destruction expertise to decommission servers and hard drives holding customer data, and many devices were resold unwiped. The firm agreed to pay $35 million without admitting or denying the findings.
What is known
| People affected | 15,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Sep 20, 2022 |
| Attack | Vendor breach |
| Data exposed | NamesFinancialOtherHealth |
| Sector | Finance · US |
| Status | Settled |
| Lawsuit or fine | $35M SEC penalty (2022) (about $35M) |
Sources
Morgan Stanley to pay $35M after hard drives with 15M customers' personal data turn up in auctionMorgan Stanley Smith Barney to Pay $35 Million for Extensive Failures to Safeguard Personal Information of Millions of CustomersHHS OCR breach report (archive, resolved): Morgan Stanley (Health Plan, NY)
Notices filed
Other breaches at Morgan Stanley
Auctioned devices with unwiped customer data; USD 6.5M multistate settlementLost or stolen device exposed names, Social Security numbers and financial details.Lost or stolen deviceFinanceUSNov 16, 2023Hacking breachHacking exposed names and Social Security numbers. Reported to the California AG.14M affectedTechUSJul 10, 2020