Morgan Stanley fined $35m for ‘astonishing’ data security breaches

Customers’ personal information left on devices sold on to third parties.

Morgan Stanley has been fined $35m by the US Securities and Exchange Commission (SEC) for “extensive failures” to protect the personal identifying information of 15 million customers over a five-year period.

On multiple occasions, Morgan Stanley hired a moving and storage company that had no experience or expertise in data destruction,

Free Trial

Register for free to keep reading.

To continue reading this article and unlock full access to GRIP, register now. You’ll enjoy free access to all content until our subscription service launches in early 2026.

  • Unlimited access to industry insights
  • Stay on top of key rules and regulatory changes with our Rules Navigator
  • Ad-free experience with no distractions
  • Regular podcasts from trusted external experts
  • Fresh compliance and regulatory content every day
Register for free Already a member? Sign in