Morgan Stanley was fined $35 million for losing 42 servers without encrypting data

CTOnews.com, September 22 (Xinhua) the Securities and Exchange Commission (SEC) has fined Morgan Stanley Smith Barney (MSSB) $35 million for failing to protect its clients' personally identifiable information (PII) within five years.

Morgan Stanley not only failed to destroy its clients' personal data from its retiring hard drives, but also hired unqualified companies to help destroy the hard drives, according to the Securities and Exchange Commission.

SEC found that Morgan Stanley did not properly dispose of storage devices containing its client's PII as early as 2015. The committee also found that in several cases Morgan Stanley had signed a data destruction service contract with a "mobile and storage company with no experience or expertise" to phase out thousands of HDD hard drives and servers containing the personal information of millions of customers.

However, instead of destroying hard drives and servers, the company that signed the contract sold them to a third party and then sold them on the Internet. In the end, Morgan Stanley found that 42 servers were lost or stolen by the contract company.

In addition, Morgan Stanley's decommissioned devices have encryption capabilities themselves, but the company has not activated encryption software for years.

CTOnews.com understood that, without acknowledging or denying its findings, Morgan Stanley agreed to SEC's order that the company had violated the safeguards and disposal rules under the Smurp regulations and agreed to pay the fine.