PC Magazine
Published in

PC Magazine

Morgan Stanley Discarded Old Hard Drives Without Deleting Customer Data First

(Credit: Getty Images/Manfred Rutz)

Some of the hard drives containing unencrypted customer data were sold on auction sites.

By Matthew Humphries

An investigation by the US Securities and Exchange Commission (SEC) discovered Morgan Stanley Smith Barney, now known as Morgan Stanley Wealth Management, put the personal information of 15 million customers at risk due to the way it handled old hard drives and servers.

Starting in 2015, and for a period spanning five years, Morgan Stanley hired a moving and storage company multiple times to handle the decommissioning of old hard drives and servers. There were two problems with this decision. The first is that the company selected to handle the drives had “no experience or expertise in data destruction services,” according to the SEC. The second problem was that Morgan Stanley didn’t encrypt the data stored on these drives, and didn’t attempt to delete any of it before handing them over to the moving company.

This scenario led to the personal data of millions of Morgan Stanley customers being available on thousands of old hard drives without any form of protection. The SEC found that instead of permanently deleting the data stored on the drives, the moving company simply sold them on to a third-party, which in turn sold some of them on internet auctions sites with the data still intact. Most of these hard drives have never been recovered.

In total, the SEC investigation discovered records showing “42 servers, all potentially containing unencrypted customer PII and consumer report information, were missing.” The devices being used by Morgan Stanley did have the ability to encrypt the data being stored, but it was never enabled.

Gurbir S. Grewal, Director of the SEC’s Enforcement Division, said that Morgan Stanley’s failures were “astonishing,” and that the company “fell woefully short” of protecting its customer’s personal information. Morgan Stanley has consented to the SEC’s finding that it “violated the Safeguards and Disposal Rules under Regulation S-P,” but did so without admitting or denying the findings. The company also agreed to pay a $35 million penalty to settle the charges against it.

Originally published at https://www.pcmag.com.



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store