Skip to content
Breach Index · running record

Morgan Stanley data breach history (2016-2026): the hardware-disposal failures, the fines, and vendor incidents

Morgan Stanley’s biggest data-security problem of the decade was not a hack. Old servers and drives holding customer data left its control without being wiped. This page sets out what regulators found, what it cost, and the vendor incidents since.

Short answer

Was Morgan Stanley hacked?

Not by an outside attacker in the sources we read, but yes, it had a confirmed data breach. Regulators found that Morgan Stanley let devices holding unencrypted customer data leave its control. The SEC’s 2022 order says a moving and storage company with no data-destruction experience decommissioned thousands of hard drives and servers from 2016, some were resold online with customer data still on them, and 42 branch servers went missing. About 15 million customers’ data was at risk.

The penalties were a $60 million OCC civil money penalty (2020), a $60 million class-action settlement (agreed January 2022), a $35 million SEC penalty (2022) and $6.5 million to six states (2023). Separately, a vendor’s Accellion file-transfer server exposed StockPlan Connect participants’ data in 2021, and in November 2025 Morgan Stanley was among banks reported to be affected by the SitusAMC vendor hack.

Timeline at a glance

  1. 22-24 Nov 2025NYT/Reuters: Morgan Stanley among banks whose client data may have been accessed in the SitusAMC hack. (Reuters)Reported
  2. Nov 2023Six states led by New York settle for $6.5M over the hardware-disposal failures. (Banking Dive)Confirmed
  3. 20 Sep 2022SEC: $35M penalty under Regulation S-P; about 15M customers’ data at risk. (SEC)Confirmed
  4. Jan 2022$60M class-action settlement filed in Manhattan federal court. (InvestmentNews)Confirmed
  5. Jul 2021Vendor Guidehouse’s Accellion server breached; StockPlan Connect data exposed. (Security Affairs)Confirmed
  6. 8 Oct 2020OCC: $60M penalty over the 2016 data-center decommissioning. (OCC)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Morgan Stanley incident timeline, in detail

Confirmed = acknowledged by Morgan Stanley, a regulator filing or a court. Reported = credible reporting Morgan Stanley has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Nov 2025ReportedThird-party / mortgage vendor

SitusAMC vendor hack: Morgan Stanley named among possibly affected banks

What happened. SitusAMC, a vendor to real estate lenders, said it was hit by a cyberattack on 12 November 2025 and that data on some clients’ customers may have been affected. The New York Times, cited by Reuters, reported that client data of JPMorgan Chase, Citi, Morgan Stanley and other banks may have been accessed.

Impact. Morgan Stanley did not immediately respond to Reuters or Bank Info Security. No Morgan Stanley customer count appears in the sources we read.

Sources: Reuters via The Star, 23 Nov 2025 · Bank Info Security, 24 Nov 2025

Nov 2023ConfirmedRegulatory / state AGs

Six states settle with Morgan Stanley for $6.5 million

What happened. A coalition led by New York Attorney General Letitia James settled with Morgan Stanley Smith Barney over the same hardware-disposal failures. The AG found the firm “failed to properly monitor the moving company’s work,” Banking Dive reported.

Impact. $6.5 million, of which New York receives $1.66 million; the rest goes to Connecticut, Florida, Indiana, New Jersey and Vermont. Morgan Stanley must encrypt all personal information, keep a written data-disposal policy and keep a vendor risk assessment team.

Sources: Banking Dive, 17 Nov 2023

2015 – Sep 2022ConfirmedRegulatory / SEC (Regulation S-P)

SEC: $35 million for failing to protect about 15 million customers’ data

What happened. The SEC’s order says Morgan Stanley Smith Barney hired a moving and storage company with no data-destruction experience to decommission thousands of hard drives and servers. The company sold some devices to a third party and some were resold on an internet auction site with customer data on them. Separately, 42 branch servers that may have held unencrypted data went missing. The devices could encrypt data, but the encryption had not been switched on for years. The failures date back to 2015.

Impact. About 15 million customers. Morgan Stanley recovered some devices but not the vast majority. It paid $35 million without admitting or denying the findings.

Sources: SEC press release 2022-168

Jan 2022ConfirmedLitigation

$60 million class-action settlement

What happened. Morgan Stanley agreed to pay $60 million to settle a class action over the decommissioned data centers and servers, filed in federal court in Manhattan. It denied the allegations.

Impact. About 15 million current and former customers. Per InvestmentNews, class members could get at least two years of fraud insurance services and claim up to $10,000 in out-of-pocket losses.

Sources: InvestmentNews, 4 Jan 2022

Jan – Jul 2021ConfirmedThird-party / file-transfer appliance

Vendor Guidehouse’s Accellion file-transfer server exposes StockPlan Connect data

What happened. Guidehouse, which provided account maintenance for Morgan Stanley’s StockPlan Connect business, told Morgan Stanley on 20 May 2021 that attackers had exploited its Accellion File Transfer Appliance. The files were encrypted, but the attackers also obtained the decryption key, Security Affairs reported.

Impact. Names, addresses, dates of birth, Social Security numbers and corporate employer names of StockPlan Connect participants. Morgan Stanley said its own systems were not breached and it had no evidence of misuse.

Sources: Security Affairs, 8 Jul 2021

2016 – Oct 2020ConfirmedRegulatory / OCC

OCC: $60 million over the decommissioning of two data centers

What happened. The OCC found that Morgan Stanley Bank and Morgan Stanley Private Bank did not properly oversee a 2016 project to retire two US wealth management data centers: weak risk assessment, poor vendor due diligence and incomplete tracking of customer data on the devices. Similar vendor-management failures recurred in 2019 when other network devices were retired.

Impact. $60 million civil money penalty (consent order EA2020-058) for unsafe or unsound practices and breaches of the interagency information security standards.

Sources: OCC news release 2020-134

Where the reports disagree

  • Who was exposed? The SEC says about 15 million customers’ data was at risk. Morgan Stanley said it had no evidence the data was accessed or misused. Both are stated in the sources; neither proves the other wrong.
  • Class settlement year: Banking Dive calls it a 2021 settlement; InvestmentNews reported the agreement filed in early January 2022. We use the filing date reported by InvestmentNews.

The pattern across the record

Disposal is part of security

Every penalty traces to hardware leaving the building unwiped, through a vendor nobody checked. Encryption existed on the devices and was not turned on.

One failure, four bills

The same decommissioning failures produced an OCC penalty, a class settlement, an SEC penalty and a multistate settlement over three years. Before this window, a 2015 insider data theft at the same broker-dealer led to a 2016 SEC penalty.

What it means for Morgan Stanley For Morgan Stanley and E*TRADE clients and StockPlan Connect participants — and what to do

The disposal case is old, but data from it may still circulate. The vendor incidents are newer.

  1. 1.Freeze your credit if you were notified

    The exposed data included Social Security numbers. A freeze with the three US bureaus is free and blocks new-credit fraud.

    SSN exposure action plan
  2. 2.Decode any new letter

    A SitusAMC or vendor letter will say what was involved. Match your response to the data listed.

    Breach notice decoder
  3. 3.Lock down your account sign-in

    Use a security key or authenticator app, not SMS, for your brokerage and stock plan accounts.

    Phishing-resistant MFA planner

CISO takeaways

Put disposal vendors in scope

ITAD and moving vendors handle your most sensitive data at its least protected moment. Score them like any processor.

Vendor Risk Scorecard
Rehearse a customer database exposure

Practise scoping and notifying when the data left on hardware you no longer track.

Customer database breach lab
Map the notification clocks

Regulation S-P, state AG and customer notices each have their own timing.

Notification clock calculator

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Morgan Stanley Smith Barney charged with failing to protect personal identifying information of approximately 15 million customers (press release 2022-168) — SEC, 20 Sep 2022
  2. 2.OCC assesses $60 million civil money penalty against Morgan Stanley (NR 2020-134) — OCC, 8 Oct 2020
  3. 3.Morgan Stanley to pay $60 million over data breach — InvestmentNews, 4 Jan 2022
  4. 4.Morgan Stanley fined $6.5M over client data breach — Banking Dive, 17 Nov 2023
  5. 5.Morgan Stanley discloses data breach (Guidehouse / Accellion) — Security Affairs, 8 Jul 2021
  6. 6.Major banks warned of data exposure after vendor hack, NYT reports — Reuters (via The Star), 23 Nov 2025
  7. 7.Major US banks gauge their exposure to SitusAMC breach — Bank Info Security, 24 Nov 2025

Frequently asked questions

Was Morgan Stanley hacked?

Not by an outside attacker in the sources we read. Its confirmed breach came from devices holding unencrypted customer data that were decommissioned without being wiped and, in some cases, resold online. The SEC put the number of customers at about 15 million.

What is the Morgan Stanley data breach settlement?

Morgan Stanley agreed to a $60 million class-action settlement in January 2022. Regulators also imposed a $60 million OCC penalty (2020), a $35 million SEC penalty (2022) and a $6.5 million six-state settlement (2023).

Why did the SEC fine Morgan Stanley $35 million?

For violating the Safeguards and Disposal Rules of Regulation S-P. A moving company with no data-destruction experience decommissioned thousands of drives and servers, some were resold online with customer data on them, and 42 servers went missing.

Morgan Stanley data breach 2025: was it affected by SitusAMC?

The New York Times, cited by Reuters, reported in November 2025 that Morgan Stanley client data may have been accessed in the SitusAMC vendor hack. Morgan Stanley did not comment in the reports we read.

What was the Morgan Stanley StockPlan Connect breach?

In 2021 attackers exploited the Accellion file-transfer server of Guidehouse, a vendor for StockPlan Connect, and took participants’ names, addresses, dates of birth and SSNs. Morgan Stanley said its own systems were not breached.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Morgan Stanley. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.