Morgan Stanley has agreed to pay $60 million to settle a lawsuit by approximately 15 million customers who claim the multinational investment bank exposed their personal data when it failed on two occasions to properly retire some of its older information technology.
On Friday, a preliminary settlement of the proposed class action was filed in Manhattan federal court, still requiring approval of US District Judge Analisa Torres.
The bank’s customers are set to receive two years of fraud insurance coverage at a minimum, with each customer able to apply for reimbursement of up to $10,000 in losses.
The bank’s customers had accused it of failing to decommission two wealth management data centres in 2016 before the equipment was sold on to unauthorised third parties. Customers also claim that some older servers containing data went missing after Morgan Stanley transferred them to an external vendor in 2019, which court papers show the bank then later recovered.
Morgan Stanley has denied wrongdoing in agreeing to settle and said in settlement papers that it has made “substantial” upgrades to its data security practices. In an email on Monday, Morgan Stanley said it had notified all customers who may have been affected.
