Investing
SEC Settles Charges With Morgan Stanley in Safeguarding Data
Published:
Last Updated:
The U.S. Securities and Exchange Commission (SEC) recently announced that Morgan Stanley (NYSE: MS) brokerage Morgan Stanley Smith Barney has agreed to pay a $1 million penalty to settle charges related to its failures to protect customer information. It’s worth noting that some of this information was hacked and offered for sale online.
The federal securities laws in place require registered broker-dealers and investment advisers to adopt written policies and procedures reasonably designed to protect customer records and information.
The agency issued an order finding that Morgan Stanley failed in its adoption of these written policies and procedures. As a result of these failures, during the span of 2011 to 2014, a then-employee impermissibly accessed and transferred the data regarding roughly 730,000 accounts to his personal server, which was ultimately hacked by third parties.
Andrew Ceresney, director of the SEC Enforcement Division, commented:
Given the dangers and impact of cyber breaches, data security is a critically important aspect of investor protection. We expect SEC registrants of all sizes to have policies and procedures that are reasonably designed to protect customer information.
According to the report:
- Morgan Stanley’s policies and procedures were not reasonable, however, for two internal web applications or “portals” that allowed its employees to access customers’ confidential account information.
- For these portals, Morgan Stanley did not have effective authorization modules for more than 10 years to restrict employees’ access to customer data based on each employee’s legitimate business need.
- Morgan Stanley also did not audit or test the relevant authorization modules, nor did it monitor or analyze employees’ access to and use of the portals.
- Consequently, then-employee Galen J. Marsh downloaded and transferred confidential data to his personal server at home between 2011 and 2014.
- A likely third-party hack of Marsh’s personal server resulted in portions of the confidential data being posted on the Internet with offers to sell larger quantities.
Take This Retirement Quiz To Get Matched With A Financial Advisor (Sponsored)
Take the quiz below to get matched with a financial advisor today.
Each advisor has been vetted by SmartAsset and is held to a fiduciary standard to act in your best interests.
Here’s how it works:
1. Answer SmartAsset advisor match quiz
2. Review your pre-screened matches at your leisure. Check out the
advisors’ profiles.
3. Speak with advisors at no cost to you. Have an introductory call on the phone or introduction in person and choose whom to work with in the future
Take the retirement quiz right here.
Thank you for reading! Have some feedback for us?
Contact the 24/7 Wall St. editorial team.
Editors' Picks
