Failure to Protect Customers Information Lands Morgan Stanley a Fine
The Securities and Exchange Commission (SEC) recently announced that Morgan Stanley Smith Barney LLC has agreed to pay a $1 million penalty to settle charges related to its failures to protect customer information, some of which was hacked and offered for sale online.
The SEC issued an order finding that Morgan Stanley failed to adopt written policies and procedures reasonably designed to protect customer data. As a result of these failures, from 2011 to 2014, a then-employee impermissibly accessed and transferred the data regarding approximately 730,000 accounts to his personal server, which was ultimately hacked by third parties.
According to the SEC’s order instituting a settled administrative proceeding: lands
- The federal securities laws require registered broker-dealers and investment advisers to adopt written policies and procedures reasonably designed to protect customer records and information.
- Morgan Stanley’s policies and procedures were not reasonable, however, for two internal web applications or “portals” that allowed its employees to access customers’ confidential account information.
- For these portals, Morgan Stanley did not have effective authorization modules for more than 10 years to restrict employees’ access to customer data based on each employee’s legitimate business need.
- Morgan Stanley also did not audit or test the relevant authorization modules, nor did it monitor or analyze employees’ access to and use of the portals.
- Consequently, then-employee Galen J. Marsh downloaded and transferred confidential data to his personal server at home between 2011 and 2014.
- A likely third-party hack of Marsh’s personal server resulted in portions of the confidential data being posted on the Internet with offers to sell larger quantities.
The SEC’s order finds that Morgan Stanley violated Rule 30(a) of Regulation S-P, also known as the “Safeguards Rule.” Morgan Stanley agreed to settle the charges without admitting or denying the findings.
Recovery of Investment Losses
The foregoing information, which is all publicly available on the SEC’s website, is being provided by The White Law Group. The White Law Group, LLC is a national securities fraud, securities arbitration, investor protection, and securities regulation/compliance law firm with offices in Chicago, Illinois and Franklin, Tennessee. For more information on the firm and it’s representation of investors, visit http://whitesecuritieslaw.com.
For a free consultation with a securities attorney, please call the firm at 888-637-5510.
Tags: Chicago broker fraud attorney, Chicago FINRA attorney, Chicago investment fraud attorney, Chicago securities attorney, Chicago securities lawyer, Morgan Stanley customer information, Morgan Stanley SEC fine, Morgan Stanley SEC penalty, Vero Beach investment fraud attorney, Vero Beach securities attorney, Vero Beach securities lawyer, Last modified: April 7, 2017
