Skip to main content    

Company Filings

U.S. Securities and Exchange Commission

                        -  About                            -  Careers 
                          -  Commissioners 
                          -  Contact 
                          -  Reports and Publications 
                          -  Securities Laws 
                          -  Mission 
                          -  Commission Votes 
                        -  Divisions & Offices                            -  Corporation Finance 
                          -  Enforcement 
                          -  Investment Management 
                          -  Economic and Risk Analysis 
                          -  Trading and Markets 
                          -  Office of Administrative Law Judges 
                          -  Examinations 
                        -  Enforcement                            -  Litigation Releases 
                          -  Administrative Proceedings 
                          -  Opinions and Adjudicatory Orders 
                          -  Accounting and Auditing 
                          -  Trading Suspensions 
                          -  How Investigations Work 
                          -  Receiverships 
                          -  Information for Harmed Investors 
                        -  Regulation                            -  Rulemaking Activity 
                          -  Proposed Rules 
                          -  Final Rules 
                          -  Interim Final Temporary Rules 
                          -  Other Orders and Notices 
                          -  Self-Regulatory Organizations 
                          -  Staff Interpretations 
                        -  Education                            -  Investor Education 
                          -  Glossaries 
                          -  Small Business Capital Raising 
                        -  Filings                            -  EDGAR – Search & Access 
                          -  EDGAR – Information for Filers 
                          -  Company Filing Search 
                          -  How to Search EDGAR 
                          -  Forms List 
                          -  About EDGAR 
                        -  News                            -  Press Releases 
                          -  Speeches and Statements 
                          -  Securities Topics 
                          -  Upcoming Events 
                          -  Webcasts 
                          -  SEC Videos 
                          -  Media Gallery 

                -  U.S. Securities and Exchange Commission                    -  Divisions & Offices 
                  -  Enforcement 
                  -  Regulation 
                  -  Education 
                  -  Filings 
                  -  Newsroom 
                -  Newsroom                    -  Press Releases 
                  -  Testimony 
                -  RSS Feeds                    -  Press Releases 
                  -  Public Statements 
                  -  Speeches 
                  -  Testimony 

## Newsroom Left Nav

-  Newsroom 
-  Press Releases 
-  Speeches and Statements 
-  SEC Stories  
-  Securities Topics 
-  Media Kit 
-  Press Contacts 
-  Events 
-  Webcasts 
-  Media Gallery 
-  RSS Feeds    -  Press Releases 
  -  Speeches and Statements 
  -  Litigation Releases 
  -  Investor Alerts 
  -  More RSS Feeds 
-  Social Media    -  @SECGov 
  -  SEC Channel 
  -  View All Social Media 

## Newsroom Left Nav

-  Newsroom 
-  Press Releases 
-  Speeches and Statements 
-  SEC Stories  
-  Securities Topics 
-  Media Kit 
-  Press Contacts 
-  Events 
-  Webcasts 
-  Media Gallery 
-  RSS Feeds    -  Press Releases 
  -  Speeches and Statements 
  -  Litigation Releases 
  -  Investor Alerts 
  -  More RSS Feeds 
-  Social Media    -  @SECGov 
  -  SEC Channel 
  -  View All Social Media 

#               Press Release            

# SEC: Morgan Stanley Failed to Safeguard Customer Data

FOR IMMEDIATE RELEASE          2016-112        

          Washington D.C.,           June 8, 2016 —        

                              - The federal securities laws require registered broker-dealers and investment advisers to adopt written policies and procedures reasonably designed to protect customer records and information.
                              - Morgan Stanley’s policies and procedures were not reasonable, however, for two internal web applications or “portals” that allowed its employees to access customers’ confidential account information.
                              - For these portals, Morgan Stanley did not have effective authorization modules for more than 10 years to restrict employees’ access to customer data based on each employee’s legitimate business need.
                              - Morgan Stanley also did not audit or test the relevant authorization modules, nor did it monitor or analyze employees’ access to and use of the portals.
                              - Consequently, then-employee Galen J. Marsh downloaded and transferred confidential data to his personal server at home between 2011 and 2014.
                              - A likely third-party hack of Marsh’s personal server resulted in portions of the confidential data being posted on the Internet with offers to sell larger quantities.

###

## Related Materials

                              - SEC order - Morgan Stanley
                              - SEC order - Marsh

SOCIAL MEDIA1Twitter 2Facebook2Instagram3RSS4YouTube6LinkedIn8Email Updates

## About The SEC

-  Budget & Performance 
-  Careers 
-  Commission Votes 
-  Contact 
-  Contracts 
-  Data Resources 

## Transparency

-  Accessibility & Disability 
-  FOIA 
-  Inspector General 
-  No FEAR Act & EEO Data 
-  Ombuds 
-  Whistleblower Protection 

## Websites

-  Investor.gov 
-  Related Sites 
-  USA.gov 

## Site Information

-  Plain Writing 
-  Privacy & Security 
-  Site Map 

**Return to Top