Morgan Stanley informs customers of possible data leak

Morgan Stanley last Friday began contacting customers whose data may have been compromised, after learning of a possible disposal issue of decommissioned hardware dating back to 2016, according to a person familiar with the matter. 

The wirehouse faced issues with two data centers that closed in 2016, in which some servers and other hardware were sold to recyclers by a vendor Morgan Stanley had hired to wipe the devices clean of client data, according to a memo from field management head Vince Lumia. 

The vendor had informed Morgan Stanley a year ago that not all of the clients’ data may have been completely scrubbed, and the wirehouse has since thoroughly and extensively investigated the matter including engaging outside experts, according to a person familiar with the matter. 

Out of an abundance of caution Morgan Stanley is notifying every person whose data could have remained on the devices as of Jan 31, 2016.   

“We have continuously monitored the situation and have not detected any unauthorized activity related to the matter, nor access to or misuse of personal client data,” a Morgan Stanley spokesperson wrote in an email.

While there was no external breach or hack to Morgan Stanley’s systems, the wirehouse is offering some current and former wealth management customers a two-year free subscription to a credit report monitoring service to compensate for the potential compromise of personal data that was being stored on decommissioned hardware.