Morgan Stanley agreed Wednesday to pay a $1 million penalty to the Securities and Exchange Commission to settle charges that it failed to protect customer information, some of which the agency says was hacked and offered for sale online.
The SEC order finds that Morgan Stanley failed to adopt written policies and procedures reasonably designed to protect customer data from 2011 to 2014.
During that time, then-employee Galen Marsh impermissibly accessed and transferred customer data regarding approximately 730,000 accounts associated with 330,000 different households to his personal server, which was ultimately hacked by third parties.
The misappropriated data included customers' full names, phone numbers, street addresses, account numbers, account balances and securities holdings.
"Given the dangers and impact of cyber breaches, data security is a critically important aspect of investor protection," said Andrew Ceresney, director of the SEC Enforcement Division, in a statement. "We expect SEC registrants of all sizes to have policies and procedures that are reasonably designed to protect customer information."
The SEC's order finds that Morgan Stanley violated Rule 30(a) of Regulation S-P, also known as the "Safeguards Rule."
Morgan Stanley agreed to settle the charges without admitting or denying the findings. In a separate order, Marsh agreed to an industry and penny stock bar with the right to apply for reentry after five years.
He was criminally convicted for his actions last year and received 36 months of probation and a $600,000 restitution order, the SEC states.
