$60 Million Settlement Resolves Class Action Over Morgan Stanley Data Breaches Affecting 15 Million Clients
Won by Arnold Law Firm.
M. Anderson Berry of Arnold Law Firm was among plaintiffs' counsel in a $60 million class action settlement against Morgan Stanley Smith Barney arising from two separate failures to secure customer data on decommissioned IT equipment, affecting approximately 15 million current and former clients.
What happened
Between 2016 and 2019, Morgan Stanley Smith Barney decommissioned data center hardware and replaced server equipment at branch offices across the country. In both instances the company failed to ensure the devices were properly wiped of customer data before they were sold or transferred to outside parties. Unencrypted hard drives and servers carrying names, addresses, Social Security numbers, birth dates, and account details belonging to roughly 15 million current and former clients ended up in the hands of people with no authorization to hold them.
Morgan Stanley did not learn of the 2016 data center incident until October 2017, when a third party reported acquiring equipment that still contained company data. The second incident, involving branch office servers, stemmed from a software flaw that left customer information unencrypted despite the company's belief that the data had been secured. Together the two events drew scrutiny from federal regulators: the Office of the Comptroller of the Currency separately fined Morgan Stanley $60 million over the same underlying conduct.
Plaintiffs filed suit in the U.S. District Court for the Southern District of New York under Case No. 1:20-cv-05914 (Tillman et al. v. Morgan Stanley Smith Barney LLC). The complaint alleged that Morgan Stanley failed to implement and follow reasonable data security practices, that those failures were foreseeable, and that the company's clients bore the resulting risk of identity theft and fraud for which they had not volunteered.
M. Anderson Berry of Arnold Law Firm, the Sacramento-based firm founded by Clay Arnold in 1975, was among the attorneys who pursued the class claims on behalf of affected customers. U.S. District Judge Analisa Torres oversaw the litigation.
At the close of 2021 the parties filed a proposed $60 million settlement. The agreement covered approximately 15 million class members and provided 24 months of fraud insurance coverage automatically, reimbursement of up to $10,000 for documented out-of-pocket losses, and up to $100 for lost time at $25 per hour for a maximum of four hours. Morgan Stanley denied liability. The court granted final approval on August 5, 2022.
Sources
This account is drawn from contemporaneous public reporting and the court record.
More proven verdicts from Arnold Law Firm
All Arnold Law Firm proven verdicts →M. Anderson Berry of Arnold Law Firm was appointed as one of three court-appointed class counsel in a consolidated class action securing a $21 million settlement for roughly 3.5 million people whose personal and financial data was exposed in a 2020 ransomware attack on global insurance broker Arthur J. Gallagher and Co.
Arnold Law Firm attorney M. Anderson Berry served as plaintiffs' co-counsel in a $17.6 million class action settlement resolving claims that Kemper Corp. and subsidiary Infinity Insurance failed to protect the personal data of approximately 6.1 million customers across two separate breaches in 2020 and 2021.
Scott Ryan Eisenbrandt Jr. was killed in a collision involving a hauling company's truck shortly after its owner bought a commercial policy in 2006. His widow and parents won a California Superior Court wrongful-death judgment of $3,964,030.77 against the truck's owner, entered January 21, 2011. They then defeated the owner's insurer in federal court, which had tried to rescind the commercial policy, and the court ordered the insurer to pay the policy's face amount with interest.
Related class action verdicts
John Eddie Williams, Jr. served as one of five private attorneys retained by the State of Texas to sue the major tobacco companies, producing a $15.3 billion settlement in January 1998, the largest single-case settlement in U.S. history at the time.
As court-appointed co-lead plaintiffs' counsel in AFFF MDL 2873, Paul J. Napoli of Napoli Shkolnik negotiated a settlement requiring 3M Company to pay up to $12.5 billion to public water systems contaminated by PFAS compounds in firefighting foam, the largest drinking-water settlement in American legal history.
As court-appointed co-lead counsel in AFFF MDL 2873, Paul J. Napoli of Napoli Shkolnik helped negotiate a $1.185 billion class settlement with DuPont, Chemours, and Corteva to compensate public water systems across the United States for PFAS contamination tied to firefighting foam.