Morgan Stanley fined millions for selling unencrypted hard drives

The U.S. asset management company Morgan Stanley sold unencrypted, decommissioned hard drives on eBay over a period of years. This gross negligence in the data protection area is now costing the company dearly and entails a fine in the millions.

Morgan Stanley sold unencrypted hard drives on eBay

The US asset management firm Morgan Stanley Smith Barney (MSSB) has been fined $35 million in the US. Over several years, the company had sold discarded, unencrypted hard drives via eBay.

And it did so without first deleting customers’ personal and confidential data, reports the magazine Heise Online, citing the US Securities and Exchange Commission (SEC). The asset manager had repeatedly contracted a company specializing in removals and storage, which had no expertise in the area of data destruction.

Thousands of hard drives and servers had been cleaned out in this way, and the unencrypted information concerned millions of customers. Most of it ended up on the eBay auction platform at some point.

15 million affected

In total, the unencrypted data, some of it personal and financial, of around 15 million customers is said to have ended up on eBay over a period of five years. Although the hardware was equipped with an encryption feature, it was simply not activated for years.

For Gurbir Grewal of the SEC, this negligence in the area of data protection is simply astonishing, as can be seen from a statement.

“Customers entrust their personal and financial information to a company and assume it will be protected. MSSB has failed miserably in this regard,” Gurbir Grewal said. In the wrong hands, this sensitive information could cause disastrous damage, Grewal added.

Morgan Stanley comes this data leak now expensive to stand. A U.S. court has fined the company $35 million. The loss of customer confidence is also likely to cost the company dearly.

The case is reminiscent of a similar incident at the beginning of 2022. In this case, almost 33,000 emails containing sensitive data from the hard drives of decommissioned PCs belonging to the Lübeck Foreigners’ Office ended up on eBay.