AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountHighContained

MORGAN STANLEY

bd_547fe0a280ba343b · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Jul 10, 2020

To disclose

—

Affected

77,296state residents only

Linked

7 filings

Confidence

68%

Full breach record for MORGAN STANLEY →15 incidents on file

Morgan Stanley notified the New Hampshire Attorney General on July 10, 2020, of two data security incidents involving approximately 77,296 NH residents. The 'Data Center Event' involved unencrypted data remaining on decommissioned devices from 2016. The 'WAAS Device Event' involved missing servers from 2019 with a software flaw leaving data unencrypted. No unauthorized access was detected. Morgan Stanley provided 24 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jul 10, 2020

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Oregon State AGbd_11f7388fd30c23a42020-07-10Candidate
Washington State AGbd_1ae5e07b0d2263112020-07-10Verified
Montana State AGbd_2fb0a16ad9d0455c2020-07-10Verified
California State AGbd_41e5015956b7b4032020-07-10Verified

Show 2 more filings ↓

Massachusetts State AGbd_a335ef95525320982020-07-10Verified
Massachusetts State AGbd_ead70df0ae64231d2020-07-10Verified

Name: MORGAN STANLEY
norm: morgan stanley
Domain: morganstanley.com

Name: MORGAN STANLEY
norm: morgan stanley
Domain: morganstanley.com
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: Jul 10, 2020
Affected individuals: 77,296state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1565 Data from Information Repositories
Regulator citations: Notified New Hampshire Attorney General Gordon MacDonald

During the incident: Worked with outside technical experts to understand the facts and any potential risks
Continuously monitored active accounts as well as internet and "dark web" forums for any evidence of misuse of Morgan Stanley data
Instituted enhanced security procedures, including continuous fraud monitoring and monitoring of information about malicious online activity and evidence of misuse of any Morgan Stanley data
Arranged with Experian to provide any potentially affected individuals with credit monitoring services for 24 months at no charge to them
Changes made: Taken steps to further strengthen controls aimed at reducing the risk that such an incident could occur in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Oregon State AGJul 10 · first

Washington State AGJul 10 · first

Montana State AGJul 10 · first

California State AGJul 10 · first

Massachusetts State AGJul 10 · first

New Hampshire State AGJul 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/morgan-stanley-20200710.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2020
Raw hash: 9ce6aa3c06c7a41888ae9027a2e4ad254cba366e8b772c748a797869abe89f63

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMORGAN STANLEY

Victim entityMORGAN STANLEY

IncidentMisconfiguration

Stated responseWorked with outside technical experts to understand the facts and any potential risks

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov