Morgan Stanley on Tuesday agreed to pay the Securities and Exchange Commission (SEC) a $35 million penalty for knowledge safety lapses that included unencrypted exhausting drives from decommissioned knowledge facilities being resold on public sale websites with out first being wiped.

The SEC motion stated that the improper disposal of hundreds of exhausting drives beginning in 2016 was a part of an “extensive failure” over a five-year interval to safeguard clients’ knowledge as required by federal laws. The company stated that the failures additionally included the improper disposal of exhausting drives and backup tapes when decommissioning servers in native branches. In all, the SEC stated knowledge for 15 million clients was uncovered.

“Astonishing failures”

“MSSB’s failures in this case are astonishing,” stated Gurbir S. Grewal, director of the SEC’s enforcement division, utilizing the initials for Morgan Stanley Smith Barney, the complete title of the agency. “Customers entrust their personal information to financial professionals with the understanding and expectation that it will be protected, and MSSB fell woefully short in doing so.”

Much of the failure stemmed from the 2016 rent of a shifting firm with no expertise or experience in knowledge destruction providers to decommission hundreds of exhausting drives and servers containing the information of hundreds of thousands of shoppers. The shifting firm acquired 53 RAID arrays that collectively contained roughly 1,000 exhausting drives, and it additionally eliminated about 8,000 backup tapes from one of many Morgan Stanley knowledge facilities.

The unnamed shifting firm initially contracted with an IT specialist to wipe or destroy any delicate knowledge saved on the drives. Eventually, the shifting firm stopped working with that specialist and started promoting the storage gadgets to an organization that in flip bought them at public sale. The new firm was by no means vetted by Morgan Stanley or accepted as a contractor or subcontractor within the decommissioning mission.

In 2017, greater than a 12 months after the information middle’s decommissioning, Morgan Stanley officers acquired an e mail from an IT marketing consultant in Oklahoma, informing them that tough drives he bought from a web based public sale website contained Morgan Stanley knowledge.

In a criticism, SEC officers wrote, “In that email, Consultant informed MSSB that ‘[y]ou are a major financial institution and should be following some very stringent guidelines on how to deal with retiring hardware. Or at the very least getting some kind of verification of data destruction from the vendors you sell equipment to.’ MSSB eventually repurchased the hard drives in Consultant’s possession.”

The SEC motion additionally stated that most of the storage gadgets didn’t have encryption turned on, although the choice existed. Even after the funding agency started utilizing encryption choices in 2018, solely new knowledge written to the disks was protected. In some circumstances, knowledge nonetheless wasn’t correctly encrypted due to a flaw in an unidentified vendor’s product.

Without admitting or denying the SEC claims, Morgan Stanley agreed to Tuesday’s discovering that it violated the Safeguards and Disposal Rules below Regulation S-P and agreed to pay the $35 million penalty.

In a press release, Morgan Stanley officers wrote, “We are pleased to be resolving this matter. We have previously notified applicable clients regarding these matters, which occurred several years ago, and have not detected any unauthorized access to, or misuse of, personal client information.”