Morgan Stanley Fined $6.5 Million for Exposing Customer Information

Morgan Stanley has agreed to a $6.5 million settlement over insecurely disposing of hardware containing unencrypted personal information.

Through negligent internal data security practices, the multinational investment bank and financial services company potentially exposed the personal information of millions of customers, the Florida Attorney General’s Office says.

An investigation into the company uncovered that it did not properly erase unencrypted personal information stored on devices that were being decommissioned.

Specifically, when looking to decommission thousands of hard drives containing sensitive consumer information, Morgan Stanley hired “a moving company with no experience in data-destruction services” and failed to monitor its actions.

The moving company, the AG says, sold the computer equipment at internet auctions without Morgan Stanley’s knowledge. Ultimately, a downstream purchaser found the data and contacted Morgan Stanley.

During another decommissioning process, the financial services company discovered 42 missing servers potentially containing unencrypted customer information. The issue, the investigation discovered, was due to “a manufacturer flaw in the encryption software”.

The investigation also found that the financial services company failed to implement proper vendor controls and asset inventories, which could have prevented the data exposure.

As part of the agreement (PDF), in addition to paying $6.5 million to the states of Florida, Connecticut, Indiana, New Jersey, New York, and Vermont, Morgan Stanley was ordered to improve the security of personal information.

Advertisement. Scroll to continue reading.

The company was ordered to encrypt data both at rest and in transit, implement a data collection, use, retention, and disposal policy, implement tools to track hardware containing personal information, and maintain an information security program, an incident response plan, and a vendor risk assessment team.

https://www.securityweek.com/morgan-stanley-ordered-to-pay-6-5-million-for-exposing-customer-information/