$60 Million Settlement Resolves Class Action Over Morgan Stanley Data Breaches Affecting 15 Million Clients

Between 2016 and 2019, Morgan Stanley Smith Barney decommissioned data center hardware and replaced server equipment at branch offices across the country. In both instances the company failed to ensure the devices were properly wiped of customer data before they were sold or transferred to outside parties. Unencrypted hard drives and servers carrying names, addresses, Social Security numbers, birth dates, and account details belonging to roughly 15 million current and former clients ended up in the hands of people with no authorization to hold them.

Morgan Stanley did not learn of the 2016 data center incident until October 2017, when a third party reported acquiring equipment that still contained company data. The second incident, involving branch office servers, stemmed from a software flaw that left customer information unencrypted despite the company's belief that the data had been secured. Together the two events drew scrutiny from federal regulators: the Office of the Comptroller of the Currency separately fined Morgan Stanley $60 million over the same underlying conduct.

Plaintiffs filed suit in the U.S. District Court for the Southern District of New York under Case No. 1:20-cv-05914 (Tillman et al. v. Morgan Stanley Smith Barney LLC). The complaint alleged that Morgan Stanley failed to implement and follow reasonable data security practices, that those failures were foreseeable, and that the company's clients bore the resulting risk of identity theft and fraud for which they had not volunteered.

M. Anderson Berry of Arnold Law Firm, the Sacramento-based firm founded by Clay Arnold in 1975, was among the attorneys who pursued the class claims on behalf of affected customers. U.S. District Judge Analisa Torres oversaw the litigation.

At the close of 2021 the parties filed a proposed $60 million settlement. The agreement covered approximately 15 million class members and provided 24 months of fraud insurance coverage automatically, reimbursement of up to $10,000 for documented out-of-pocket losses, and up to $100 for lost time at $25 per hour for a maximum of four hours. Morgan Stanley denied liability. The court granted final approval on August 5, 2022.