Morgan Stanley Agrees to $60M Settlement in Data Security Lawsuit

Investment bank Morgan Stanley has reached a $60 million settlement in the class-action lawsuit filed by customers who say their data was exposed when the Wall Street bank failed to competently dispose of IT equipment.

The lawsuit is on behalf of around 15 million customers, and it stems from two separate incidents, one in 2016 and one in 2019 when it is alleged that Morgan Stanley did not properly dispose of IT equipment containing personal customer data. It is claimed that in 2016, the company did not erase customer data from two wealth management data centers before selling them to third parties. And in a similar but unrelated case in 2019, the affected customers claim the bank transferred old IT systems to an outside vendor, once again without erasing customer data.

A preliminary settlement was filed last Friday night in Manhattan federal court, but it still requires approval by U.S. District Judge Analisa Torres. If everything is to go through, however, all affected customers would receive a minimum of two years fraud insurance coverage and be able to apply for up to $10,000 to cover any out-of-pocket losses.

The firm denies any wrongdoing in agreeing to settle, although in the time since the two incidents says that it has made “substantial” improvements to its data security practices.

Even though the settlement isn’t yet finalized, in a recent email Morgan Stanley said that it has notified all affected customers and that it was pleased to reach a settlement in this lawsuit.