Banking giant pays $6.5M for data breach. In CT, 200,000+ had personal information exposed

Kenneth R. Gosselin, Hartford Courant
·3 min read

Connecticut will share in a $6.5 million settlement with Morgan Stanley to resolve a complaint the investment banking giant compromised the personal information of its clients because of negligent internal data security practices.

In Connecticut, 220,000 Morgan Stanley clients were affected. The settlement is being shared with five other states, with Connecticut receiving $754,000. The proceeds will go into the state’s general fund.

Connecticut Attorney William Tong said there was a breakdown in security practices when old computer devices were decommissioned and there was a failure to erase unencrypted data that exposed the personal information of millions of consumers.

“Morgan Stanley failed to employ basic data security measures when selling-off old computer devices,” Tong said, in a release. “Their negligence exposed personal data for hundreds of thousands of their Connecticut customers. In addition to a substantial payment, our settlement today forces Morgan Stanley to commit to a series of strong data security measures to ensure these careless errors do not occur again.”

In a statement, a Morgan Stanley spokesperson said: ““We have previously notified all potentially impacted clients regarding these matters, which occurred several years ago, and are pleased to have resolved this related investigation.”

As far back as 2015, Tong said, Morgan Stanley failed to properly dispose of devices containing its customers’ personal information by hiring a moving company with no experience in data destruction services. The company, Tong said, failed to monitor the moving company’s work, and the computer equipment was sold via internet auctions, some of which contained customer data. The company was not alerted to the problem until a downstream purchaser discovered the data and called the company, Tong said.

In a second incident, a records reconciliation exercise undertaken by the company during a decommissioning process revealed that 42 servers, all potentially containing unencrypted customer information, were missing, Tong said.

The investigation finds that Morgan Stanley had failed to maintain adequate vendor controls and hardware inventories, and that had these controls been in place, both data security events could have been prevented.

The security incident at Morgan Stanley, which first surfaced in media reports in 2020, was not related to an external hack or breach.

The settlement agreement also calls for Morgan Stanley to:

• Maintain a comprehensive information security program that includes regular updates that are necessary to reasonably protect the privacy, security, and confidentiality of personal information;

• Maintain an incident response plan that documents incidents and actions taken in relation to the incidents;

• Maintain a written policy that governs the collection, use, retention, and disposal of consumers’ personal information;

• Encrypt all personal information, whether stored or transmitted, between documents, databases, or elsewhere;

• Employ a manual process and automated tools to keep track of locations of all hardware that contains personal information;

• Maintain a vendor risk assessment team to assess and monitor that their vendors are in compliance with Morgan Stanley’s data security requirements.

Connecticut was joined in settlement by New York, Florida, Indiana, New Jersey and Vermont.

Kenneth R. Gosselin can be reached at kgosselin@courant.com.