Skip to main content
  • Call
    Contact Us

    TOLL FREE: 1-866-9-NO-SCAM

     
  • File Complaint
Logo
  • Home
  • Meet the Attorney General
    • Attorney General James Uthmeier
    • Official Photo
  • About the Office
    • Departments
      • AG Opinions
      • Antitrust
      • Civil Legal Services
      • Civil Litigation
      • Consumer Protection
      • Criminal Appeals
      • Litigation Services
      • Medicaid Fraud
      • Parental Rights
      • Solicitor General
      • Statewide Prosecution
    • Programs
      • Back the Blue
      • Be a Florida Hero
      • Consumer Alerts
      • Criminal Justice Programs
      • Military and Veterans Assistance Program
      • Seniors vs. Crime
      • Cold Case Investigations Unit
    • Services
      • Civil Rights
      • Human Trafficking Prevention and Awareness
      • Identity Theft
      • Lemon Law
      • Office of Inspector General
      • Open Government
      • Victims Services
  • Contact Us
    • Addresses & Phone Numbers
    • File A Complaint
    • General Inquiries
    • Media Contact
Logo
  • Home
  • Meet the Attorney General
    • Attorney General James Uthmeier
    • Official Photo
  • About the Office
    • Departments
      • AG Opinions
      • Antitrust
      • Civil Legal Services
      • Civil Litigation
      • Consumer Protection
      • Criminal Appeals
      • Litigation Services
      • Medicaid Fraud
      • Parental Rights
      • Solicitor General
      • Statewide Prosecution
    • Programs
      • Back the Blue
      • Be a Florida Hero
      • Consumer Alerts
      • Criminal Justice Programs
      • Military and Veterans Assistance Program
      • Seniors vs. Crime
      • Cold Case Investigations Unit
    • Services
      • Civil Rights
      • Human Trafficking Prevention and Awareness
      • Identity Theft
      • Lemon Law
      • Office of Inspector General
      • Open Government
      • Victims Services
  • Contact Us
    • Addresses & Phone Numbers
    • File A Complaint
    • General Inquiries
    • Media Contact

Breadcrumb

  1. Home
  2. News Releases
  3. Attorney General Moody Recovers 65 Million Morgan Stanley Over Two Data Security

Attorney General Moody Recovers $6.5 Million from Morgan Stanley Over Two Data-Security Incidents

View PDF
Release Date
Nov 16, 2023
Contact
Kylie Mason
Phone
(850) 245-0150

''

TALLAHASSEE, Fla.—Attorney General Ashley Moody, along with five other attorneys general, secured a $6.5 million agreement with Morgan Stanley Smith Barney LLC, also known as Morgan Stanley. The action comes after an investigation found that Morgan Stanley compromised the personal information of its customers due to negligent internal data-security practices. Morgan Stanley potentially exposed millions of consumers’ personal information through a failure to properly erase unencrypted data when disposing of the company’s computer devices.

Attorney General Ashley Moody said, “This company put the personal information of millions of its customers at risk through the mishandling of decommissioned devices. Now, Morgan Stanley will have to pay $6.5 million and take steps to ensure customer data is protected.”

An investigation into Morgan Stanley uncovered that the company failed to properly dispose of devices containing its customers’ personal information by hiring a moving company with no experience in data-destruction services to decommission thousands of hard drives and servers containing sensitive information of millions of its customers. Morgan Stanley failed to properly monitor the moving company that used internet auctions to sell the computer equipment. Morgan Stanley did not know about the problem until a downstream purchaser discovered the data and contacted the company.

In a second incident, Morgan Stanley discovered 42 missing servers during a decommissioning process, all potentially containing unencrypted customer information. During this process, the company learned that local devices being decommissioned possibly contained unencrypted data due to a manufacturer flaw in the encryption software.

The investigation found that Morgan Stanley failed to maintain adequate vendor controls and hardware inventories, and that if these controls were in place, both data-security events could have been prevented. 
 
As a result of today’s action, Morgan Stanley will pay $6.5 million to the states. In addition, Morgan Stanley must adopt the following provisions to strengthen personal information protection for its consumers: 

  • Encrypt all personal information, whether stored or transmitted, between documents, databases or elsewhere;
  • Maintain a written policy that governs the collection, use, retention and disposal of consumers’ personal information;
  • Employ a manual process and automated tools to keep track of locations of all hardware that contains personal information;
  • Maintain a comprehensive information security program that includes regular updates that are necessary to reasonably protect the privacy, security and confidentiality of personal information;
  • Support an incident response plan that documents incidents and actions taken in relation to the incidents; and
  • Maintain a vendor risk assessment team to assess and monitor that their vendors are in compliance with Morgan Stanley’s data-security requirements.

In addition to Florida, represented by Consumer Protection Division Multistate and Privacy Bureau Chief Patrice Malloy and Senior Assistant Attorney General Diane Oates, the following states joined the action: Connecticut, Indiana, New Jersey, New York and Vermont.

To view a copy of the agreement, click here.

# # #

Resources

  • AG Opinions
  • Annual Regulatory Plan
  • Consumer Protection
  • Doing Business with the Office
  • FAQ
  • Florida Digital Bill of Rights Annual Enforcement Report
  • Opioid Settlements
  • Statement of Agency Organization and Operation

Quick Links

  • Consumer Alerts
  • Military and Veterans Assistance Program
  • Open Government
  • Dose of Reality Florida
  • Request for Proposal for Professional Legal Services – PFAS
  • Request for Proposal for Professional Legal Services – Polychlorinated biphenyls
  • Request for Proposal for Professional Legal Services – Insulin
  • Crime Prevention Summit

 

  • Employment
  • File a Complaint
  • Human Trafficking Summit
  • Victim Services
  • Dozier Claims
  • Nicotine Dispensing Device Directory
Logo

Office of the Attorney General
State of Florida
PL-01, The Capitol
Tallahassee, FL 32399-1050

Privacy Policy | © 2025 State of Florida. All rights reserved.