On Tuesday, the Securities and Exchange Commission (SEC) charged financial company Morgan Stanley a $35M fine for “the firm’s extensive failures, over five years, to protect the personal identifying information, or PII, of approximately 15 million customers. The company agreed to settle the penalty.

360 Mobile Vision - 360mobilevision.com North & South Carolina Security products and Systems Installations for Commercial and Residential - $55 Hourly Rate. ACCESS CONTROL, INTRUSION ALARM, ACCESS CONTROLLED GATES, INTERCOMS AND CCTV INSTALL OR REPAIR 360 Mobile Vision - 360mobilevision.com is committed to excellence in every aspect of our business. We uphold a standard of integrity bound by fairness, honesty and personal responsibility. Our distinction is the quality of service we bring to our customers. Accurate knowledge of our trade combined with ability is what makes us true professionals. Above all, we are watchful of our customers interests, and make their concerns the basis of our business.

As early as 2015, Morgan Stanley wasn’t properly disposing of devices containing sensitive customer data, according to a press release. In one instance, it hired a moving company with “no experience or expertise” in data destruction to eliminate thousands of devices containing hard drives and servers with thousands of unencrypted customer data. The company later auctioned these devices online with data still intact.

Gurbir Grewal, the SEC’s director of the Division of Enforcement, described Morgan Stanley’s failures as “astonishing”.

“Customers entrust their personal information to financial professionals with the understanding and expectation that it will be protected, and MSSB fell woefully short in doing so,” Grewal said in a statement. “If not properly safeguarded, this sensitive information can end up in the wrong hands and have disastrous consequences for investors. Today’s action sends a clear message to financial institutions that they must take seriously their obligation to safeguard such data.”

Morgan Stanley recovered some of the re-sold assets, but “a vast majority” of these devices were not.

On top of that, 42 servers, potentially containing unencrypted data by the thousands, from a local office and branch servers Morgan Stanley shut down went “missing”.

Regardless of the amount of data that was “misplaced” for seven years, the company said it’s not aware any of the lost sensitive data were exploited.

“We have previously notified applicable clients regarding these matters, which occurred several years ago, and have not detected any unauthorized access to, or misuse of, personal client information,” a spokesperson from Morgan Stanley said in a statement to CNN.

By admin