In September 2022 the SEC announced a 35 million dollar penalty against Morgan Stanley Smith Barney for failing, over five years, to protect the personal information of about 15 million customers when decommissioning hardware. The lesson is plain: retired disks and servers still hold data, and a vendor with no destruction experience is a control failure.
What the SEC found
The SEC's release says MSSB violated the Safeguards and Disposal Rules under Regulation S-P. It found that, starting as early as 2015, the firm hired a moving and storage company with no data destruction experience to decommission thousands of hard drives and servers, and did not adequately monitor its work for several years.
That company sold thousands of devices to a third party. Some were resold on an internet auction site with customer information still on them. A records reconciliation during a hardware refresh also found 42 servers missing that could have held unencrypted information.
The SEC added that the local devices had encryption capability, but the firm had not activated the encryption software for years. MSSB neither admitted nor denied the findings.
Where the chain broke
Four separate controls failed, and any one would have helped:
- Vendor selection: nobody checked that the contractor could destroy data.
- Oversight: the work went unmonitored for years.
- Inventory: servers could not be accounted for.
- Encryption: available protection was never switched on.
A retirement checklist
- Keep an asset inventory that records where each device holds data, and update it when devices move.
- Turn on full disk encryption at deployment, not at retirement, so a lost device is a lesser event.
- Choose a disposal provider that can show destruction methods and issue a certificate per serial number.
- Reconcile the certificates against the inventory every time.
- Audit the provider on a schedule, including a sample visit.
- Treat any unreconciled device as an incident until proven otherwise.
Does this apply outside finance?
Regulation S-P is a financial rule, but the pattern applies wherever devices hold personal data. Health records, student records and customer databases sit on the same kinds of drives. Check what your own rules require, and ask counsel about specifics.
Where tooling helps
An inventory is only as good as its discovery. Safeguard's asset discovery can help find systems that should be in the record, and its compliance and evidence automation can keep disposal certificates and reconciliations attached to the controls they support.
Quick check
Did the SEC say the devices were hacked?
No. The findings are about improper disposal and oversight, with some devices resold with data still on them.
What is the simplest control that would have reduced the harm?
Enabling the encryption the devices already supported, so resold drives would not expose readable data.
Sources
Last reviewed: 19 October 2026.
