Morgan Stanley faces seven class action lawsuits related to an ITAD vendor’s alleged lapse in data security protocols, and the financial institution is considering legal action against the unnamed processor.
The financial institution in July reported multiple possible data breaches related to ITAD services performed in 2016 and 2019. Data remained on devices following an ITAD vendor’s data center decommissioning service, and the vendor was unable to account for some servers that were retired from branch offices.
After two initial lawsuits were filed in late July, five more have followed, all accusing Morgan Stanley of negligence, breach of contract, violation of data security laws and more.
Morgan Stanley’s “negligence in safeguarding its customers’ [personally identifiable information] is inexplicable in light of the numerous data breaches that have occurred in the past several years and the repeated warnings and alerts directed to companies and consumers regarding the need to take proper measures to protect and secure data maintained electronically,” wrote attorneys representing plaintiff Amy Dalton in an Aug. 14 filing.
Morgan Stanley declined to comment to E-Scrap News on the new lawsuits, beyond referring to the company’s initial remarks about the incident. The company in early August said it has “continuously monitored the situation and have not detected any unauthorized activity related to the matter, nor access to or misuse of personal client data.”
The plaintiffs in the lawsuits are all account holders with Morgan Stanley. They include residents of Florida, Pennsylvania, California, New York, Illinois and New Jersey. Morgan Stanley issued data breach letters in numerous states, including California, Massachusetts, and New Hampshire.
The lawsuits were all filed in the U.S. District Court for the Southern District of New York and they are all assigned to the same judge, Analisa Torres. All seven complaints use similar language and make similar claims.
Turning attention on ITAD firm
A person with knowledge of the situation told E-Scrap News Morgan Stanley is considering legal action against its ITAD vendor, although the financial institution has not publicly announced such plans. Interest in a lawsuit against the processor was first reported by AdvisorHub, which also cited an unnamed source familiar with the situation.
The possibility of a lawsuit against the ITAD firm has raised eyebrows in the asset disposition sector. Kyle Marks, who runs Retire-IT and previously wrote about the Morgan Stanley situation, told E-Scrap News such legal action would have wide-ranging impacts.
“There will be a chilling effect on the entire ITAD industry if Morgan Stanley takes legal action against the vendor it hired to handle decommissioning,” Marks said. “A legal action would discourage other ITAD vendors from disclosing future incidents. Rather than encouraging disclosures, ITAD vendors that become aware of potential problems would be motivated to remain silent.”
