Morgan Stanley agrees to pay $35 million fine for data security lapses 

Morgan Stanley will pay a $35 million fine to the Securities and Exchange Commission for data security failures. This includes reselling unencrypted hard drives from decommissioned data centers on auction platforms without first deleting them and not safeguarding the information of customers when displacing company hard drives and servers.

According to the SEC, Morgan Stanley’s actions in 2016 were part of a larger failure to protect customers’ data, as required by federal rules, and it outed data from 15 million of its customers by hiring a moving company with no experience or expertise in data destruction to destroy hard drives and servers containing customer data.

It went on to say that many of these storage devices were not even encrypted, despite the fact that the option existed.

Morgan Stanley provided the moving company with 53 RAID arrays with about 1,000 hard drives and about 8,000 backup tapes, and the company hired an IT specialist to destroy the sensitive data stored on the hard drives.

The moving company terminated its cooperation with that specialist and began selling the storage devices to a company, which then auctioned them off, until Morgan Stanley received an email in 2017 from an IT consultant informing them that hard drives, he had bought from an online auction site contained Morgan Stanley data.

Morgan Stanley agreed with the SEC’s finding that it violated the Safeguards and Disposal Rules under the S-P regulation and agreed to pay the $35 million penalty.

The sources for this piece include an article in ArsTechnica.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web