Through negligent internal data security practices, the multinational investment bank and financial services company potentially exposed the personal information of millions of customers.
The moving company, the AG says, sold the computer equipment at internet auctions without Morgan Stanley's knowledge.
The company was ordered to encrypt data both at rest and in transit, implement a data collection, use, retention, and disposal policy, implement tools to track hardware containing personal information, and maintain an information security program, an incident response plan, and a vendor risk assessment team.
[
add
]
[
|
|
...
]