$35M fine for Morgan Stanley after unencrypted, unwiped hard drives are auctioned

Morgan Stanley on Tuesday agreed to pay the Securities and Alternate Fee (SEC) a $35 million penalty for information safety lapses that included unencrypted arduous drives from decommissioned information facilities being resold on public sale websites with out first being wiped.

The SEC motion stated that the improper disposal of 1000’s of arduous drives beginning in 2016 was a part of an “intensive failure” over a five-year interval to safeguard prospects’ information as required by federal rules. The company stated that the failures additionally included the improper disposal of arduous drives and backup tapes when decommissioning servers in native branches. In all, the SEC stated information for 15 million prospects was uncovered.

“Astonishing failures”

“MSSB’s failures on this case are astonishing,” stated Gurbir S. Grewal, director of the SEC’s enforcement division, utilizing the initials for Morgan Stanley Smith Barney, the complete title of the agency. “Clients entrust their private info to monetary professionals with the understanding and expectation that will probably be protected, and MSSB fell woefully quick in doing so.”

A lot of the failure stemmed from the 2016 rent of a shifting firm with no expertise or experience in information destruction companies to decommission 1000’s of arduous drives and servers containing the information of thousands and thousands of shoppers. The shifting firm acquired 53 RAID arrays that collectively contained roughly 1,000 arduous drives, and it additionally eliminated about 8,000 backup tapes from one of many Morgan Stanley information facilities.

The unnamed shifting firm initially contracted with an IT specialist to wipe or destroy any delicate information saved on the drives. Ultimately, the shifting firm stopped working with that specialist and commenced promoting the storage gadgets to an organization that in flip bought them at public sale. The brand new firm was by no means vetted by Morgan Stanley or accredited as a contractor or subcontractor within the decommissioning challenge.

In 2017, greater than a yr after the information heart’s decommissioning, Morgan Stanley officers acquired an e-mail from an IT advisor in Oklahoma, informing them that arduous drives he bought from a web based public sale web site contained Morgan Stanley information.

In a criticism, SEC officers wrote, “In that e-mail, Guide knowledgeable MSSB that ‘[y]ou are a significant monetary establishment and needs to be following some very stringent pointers on learn how to cope with retiring {hardware}. Or on the very least getting some sort of verification of knowledge destruction from the distributors you promote gear to.’ MSSB finally repurchased the arduous drives in Guide’s possession.”

The SEC motion additionally stated that lots of the storage gadgets didn’t have encryption turned on, although the choice existed. Even after the funding agency started utilizing encryption choices in 2018, solely new information written to the disks was protected. In some instances, information nonetheless wasn’t correctly encrypted due to a flaw in an unidentified vendor’s product.

With out admitting or denying the SEC claims, Morgan Stanley agreed to Tuesday’s discovering that it violated the Safeguards and Disposal Guidelines below Regulation S-P and agreed to pay the $35 million penalty.

In an announcement, Morgan Stanley officers wrote, “We’re happy to be resolving this matter. We’ve got beforehand notified relevant shoppers concerning these issues, which occurred a number of years in the past, and haven’t detected any unauthorized entry to, or misuse of, private consumer info.”