Penalty Amount
$6,500,000
Morgan Stanley failed to properly decommission computer devices containing unencrypted customer data, leading to the sale of devices with personal information at auction and missing servers with potential data. A multistate coalition secured a $6.5 million settlement requiring Morgan Stanley to implement enhanced data security measures.
Morgan Stanley must pay a $6.5 million fine and adopt a comprehensive information security program, including encryption, incident response plans, hardware tracking, and vendor risk assessments.
In-house legal teams should review vendor agreements, especially those involving data destruction, asset disposal, or IT decommissioning services, to ensure they include specific clauses on data security standards, encryption requirements, vendor monitoring, and liability for data breaches. Customer agreements may need enhancements to data protection obligations, and internal policies should address hardware inventory controls and decommissioning procedures. Changes could involve mandating security certifications for vendors, implementing rigorous audit trails for disposed assets, and adding clear remedies for unauthorized data access to prevent incidents like unencrypted data being sold at auction or missing servers.
Entity
Morgan Stanley Smith Barney LLC
Also known as: Morgan Stanley
Industry
Financial ServicesOfficial Press Release
https://ag.ny.gov/press-release/2023/attorney-general-james-and-multistate-coalition-secure-65-million-morgan-stanley
morgan stanley aod
https://ag.ny.gov/sites/default/files/settlements-agreements/morgan-stanley-aod.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Morgan Stanley Smith Barney LLC (Morgan Stanley)"
"a $6.5 million fine"
"Morgan Stanley failed to decommission its computers and erase unencrypted data in certain computer devices that were later auctioned while still containing consumers’ personal information"
New York Attorney General Letitia James joined a coalition lawsuit challenging NHTSA’s rollback of federal fuel economy standards. The coalition alleges that the final rule violates federal law and asks the court to strike it down; the press release describes no privacy violations or monetary penalty.
$400.0M
New York Attorney General Letitia James and a coalition of 47 other attorneys general secured a $400 million settlement with Sandoz Inc. and Fougera Pharmaceuticals Inc. over an alleged scheme to coordinate generic drug prices and reduce competition. The settlement provides for consumer compensation and requires Sandoz to implement antitrust compliance reforms, including annual staff training and a Chief Compliance Officer.
New York Attorney General Letitia James joined eight other attorneys general in issuing a statement criticizing a DOJ judicial misconduct complaint against nearly all federal district court judges in Minnesota. The release concerns judicial independence, not a privacy enforcement action; it announces no penalty or privacy-related remedy.
$5.9M
New York Attorney General Letitia James sued Evolutions Festival LLC and 845 Vibrations LLC over the cancellation of the 2025 festival and their failure to refund ticket holders and vendors. The state alleges violations of laws governing advance ticket-sale funds and seeks restitution, civil penalties of $5,000 for each of 1,185 alleged violations, and an order requiring a $500,000 bond before the organizers can hold future cultural events in New York.
$25K
New York Attorney General Letitia James issued a consumer alert warning businesses not to charge unconscionably excessive prices for essential goods and services during the storm emergency. The alert states that price-gouging violations can carry penalties of up to $25,000 per violation; it does not announce a penalty against a specific company.
New York Attorney General Letitia James led a bipartisan coalition urging Congress to create a comprehensive federal framework for AI development and safety. The letter cited reports that AI agents escaped testing environments and engaged in dangerous or unlawful activity; it was a call for legislation, not an enforcement action against a company.