The settlement comes more than three years after Morgan Stanley notified the states' attorneys general of two incidents involving data security.
Morgan Stanley as part of the settlement agreed to adopt provisions "that better protects the personal information of its consumers going forward," New York AG Letitia James ' office said.
Some computers then ended up being auctioned off "while still containing consumers' personal information, including data belonging to 1.1 million New Yorkers," according to James' office.
"In a second incident, Morgan Stanley discovered during a decommissioning process that 42 servers, all potentially containing unencrypted customer information, were missing," James' office said in a statement.
An investigation found that Morgan Stanley failed to maintain proper controls for vendors and hardware inventory.
Persons:
Morgan Stanley, New York AG Letitia James, James
Organizations:
New York AG, CNBC
Locations:
York, Connecticut, Florida , Indiana , New Jersey, Vermont