Morgan Stanley Data Security Settlement

The Court authorized this website to inform you about the proposed Settlement of this class action lawsuit known as In re Morgan Stanley Data Security Litigation, 1:20-cv-05914-AT (S.D.N.Y.) (the “Action”) and about all of your options before the Court decides whether to give “final approval” to the Settlement.

Judge Analisa Torres of the United States District Court for the Southern District of New York is overseeing this case. The people who brought the lawsuit are called the Plaintiffs. Morgan Stanley Smith Barney LLC (“Morgan Stanley”) is called the Defendant.

The lawsuit claims that Morgan Stanley is responsible for two separate data security incidents, (which we refer to collectively as Data Security Incidents), that Plaintiffs allege compromised the personal identifying information, (which we refer to as PII) of approximately 15 million of Morgan Stanley’s current and former clients. Plaintiffs allege that in 2016 and 2019, Morgan Stanley failed to properly dispose of information technology (“IT”) equipment containing client's PII. Many of these IT devices were sold to third parties and remain unaccounted for. Plaintiffs allege that, as a result of the Data Security Incidents, unauthorized third parties potentially gained access to sensitive and private information of Morgan Stanley’s current and former clients. The IT equipment at issue may have retained Morgan Stanley client PII such as: names, work and home addresses, Social Security numbers, driver’s license numbers, income, asset value, asset holding information, passport information, telephone numbers, family members’ names, dates of birth and other financial and personal information.

The lawsuit asserts claims including: negligence, invasion of privacy, breach of implied contract, negligence per se, breach of fiduciary duty, and breach of confidence. The lawsuit seeks compensation for people who had losses as a result of the Data Security Incidents.

Morgan Stanley denies all of Plaintiffs’ claims, denies any liability whatsoever, and believes that no member of the Settlement Class, including the Plaintiffs, has sustained any damages or injuries due to the Data Security Incidents.

In a class action, one or more people called “Class Representatives” or “Plaintiffs” sue on behalf of all people who have similar claims. All the people who have claims similar to the Plaintiffs are known as Class Members, except for those who exclude themselves from the class.

In this case, the Class Representatives are John and Midori Nelson, Sylvia Tillman, Mark Blythe, Vivian Yates, Cheryl and Richard Gamen, Amresh Jaijee, Richard Mausner, Desiree Shapouri, and Howard Katz.

By agreeing to settle, both sides avoid the cost and risk of a trial, and Settlement Class Members who submit a valid claim will promptly get compensation. The Class Representatives and their attorneys believe the Settlement is fair, reasonable, and adequate and, thus, in the best interests of the Settlement Class and its members. The Settlement is not an admission that Morgan Stanley did something wrong, but rather is an agreement to end the lawsuit.

You are included in the Settlement if you have or had a Morgan Stanley account established in the United States and were sent a notice letter of the Data Security Incidents by Morgan Stanley in July 2020 and/or June 2021. If you are a member of the Settlement Class, you should have received a Settlement notice from the Settlement Administrator in the mail or by email. That notice included a unique code for you to verify your identity to receive certain Settlement benefits described further in FAQ 7. If for some reason you have not received a unique code, but believe you are a Settlement Class Member, please call 1-855-604-1744 (Toll-Free) to verify your identity and receive further information.

Specifically excluded from the Settlement Class are:

1. Morgan Stanley;
2. The subsidiaries, parents, and affiliates of Morgan Stanley;
3. Any directors and senior executive officers of the entities covered by (i) and (ii) during the Class Period and members of their immediate families;
4. Any firm, trust, corporation, or other entity in which Morgan Stanley has or had a controlling interest; and
5. The legal representatives, heirs, successors, and assigns of any such excluded persons or entities.

Also excluded from the Class are Settlement Class Members who timely and validly request exclusion from the Settlement Class (for more information about requesting exclusion see FAQ 13, FAQ 14 and FAQ 15).

If you are not sure whether you are included in the Settlement, or have any other questions related to the Settlement, you may call 1-855-604-1744 (Toll-Free) with questions. You may also write with questions to Morgan Stanley Data Security Settlement, Settlement Administrator, PO Box 6758, Portland, OR 97228-6758.

Please do not contact the Court with questions.

To fully settle and release the claims of the Settlement Class Members related to the Data Security Incidents, Morgan Stanley has agreed to establish a $60 million fund (the “Settlement Fund”) to:

1. Make fraud insurance coverage available to all Settlement Class Members for a period of at least 24 months;
2. Make payments to Settlement Class Members who file a valid claim for out-of-pocket losses and lost time spent researching and remedying issues related to the Data Security Incidents; and
3. Pay for attorneys’ fees, costs, and expenses incurred by counsel for the Settlement Class as well as service awards for Plaintiffs.

Additionally, Morgan Stanley has agreed to hire a third party to attempt to locate and retrieve additional decommissioned IT devices which have been sold to third parties. Morgan Stanley has also made substantial changes to its data security practices.

In addition, Morgan Stanley will pay reasonable costs of notice and administration of this Settlement separately from the Settlement Fund.

All Settlement Class Members will also be provided access to Financial Shield for a period of at least 24 months from the Effective Date of the Settlement without the need to submit a Claim Form.

A link with a redeemable code to be used to enroll directly with Financial Shield was provided in the Notice you received from the Settlement Administrator in the mail or by email. The insurance fraud coverage provided focuses on protecting financial assets, freezing identity at 10 different bureaus including the three main credit bureaus, home and property title monitoring, income tax protection and other services. Unlike traditional credit monitoring which focuses on identifying attempts to open new accounts in your name, Financial Shield provides real-time monitoring of your existing financial and investment accounts to alert you of any account changes and account takeover attempts, such as changes in address, a new signatory request, or requesting a replacement credit card. More information on the coverage may be found in FAQ 9.

The Settlement also provides for substantial monetary relief. The Settlement Fund is being used to make payments to people who submitted valid claims for expenses and/or lost time incurred as a result of the Data Security Incidents. The deadline to file a claim passed on August 11, 2022.

Settlement Class Members who spent time researching or remedying issues related to the Data Security Incidents could have filed a claim to receive reimbursement for up to four (4) hours at a rate of $25 per hour, with an attestation that their actions were taken in response to the Data Security Incidents. No separate documentation was required for claims for lost time up to four (4) hours.

Settlement Class Members who filed timely claims are eligible to receive reimbursement of up to $10,000 (in total per Settlement Class Member) for out-of-pocket expenses such as: unreimbursed losses relating to fraud or identity theft; professional fees including attorneys’ fees, accountants’ fees, and fees for credit repair services; costs associated with freezing and unfreezing credit with any credit reporting agency; credit monitoring costs that were incurred on or after July 1, 2020, through the date of claim submission; miscellaneous expenses such as notary, fax, postage, copying and mileage; and reimbursement of up to an additional five (5) hours of time if Settlement Class Members were able to document time lost remedying issues related to the Data Security Incidents (at $25 per hour or, if you lost work, at a rate of documented compensation up to $50 per hour). Reasonable documentation must have been submitted with your Claim Form showing that the Data Security Incidents caused the costs incurred in order to receive reimbursement for out-of-pocket expenses.

If there is insufficient money in the Settlement Fund to pay all claims, claims for out-of-pocket losses and lost time will be reduced on a pro rata basis (equal share). If money remains in the Settlement Fund after the payment of all claims, attorneys’ fees, costs, and expenses, and service awards to the Class Representatives, the remaining money will be used to extend the coverage period for Financial Shield services for all Settlement Class Members.

At least 24 months of Financial Shield are available to all Settlement Class Members without the need to file a Claim Form. Settlement Class Members will need to register for the service through this website here within 24 months of the Effective Date of the Settlement using the "Financial Shield Code" sent in the Settlement Notice. If you did not receive a Financial Shield Code, but believe you are a Settlement Class Member, please call the Settlement Administrator at 1-855-604-1744 (Toll-Free) to verify your identity and receive further information.

To get a monetary payment from the Settlement, you must have filed a Claim Form.

If your Claim Form was determined to be complete and valid, you were mailed a check or sent an email to select a digital payment option on December 12, 2022.

The Settlement Administrator decided whether the information provided on a Claim Form was complete and valid by reviewing your claim and all documents sent in support of your claim, including any responses received from a Notice of Defective Claim or Notice of Denied Claim. The decision was made following the terms and requirements set out within the Settlement Agreement, which is available in the Documents section of this website.

You do not have to do anything to remain in the Settlement, but if you wanted a payment, you must have submitted a Claim Form online or postmarked by August 11, 2022. To obtain the fraud insurance coverage, you need to register within 24 months of the Effective Date of the Settlement with the Financial Shield Code provided to you.

Since the Settlement is final, unless you excluded yourself, you gave up your right to bring a separate action against Morgan Stanley for any claims related to the Data Security Incidents. The specific claims you gave up against Morgan Stanley are described in Section 13 of the Settlement Agreement.

The Settlement Agreement describes the released claims with specific descriptions, so read it carefully. If you have any questions you can talk to the law firms listed in FAQ 16, or you can, of course, talk to your own lawyer at your own expense.

No. If you excluded yourself, you will not be entitled to any benefits, including Financial Shield Services or any money from the Settlement. You will also not be bound by any judgment in this case. If you excluded yourself, you may not have submitted a Claim Form to ask for a payment and you may not enroll in Financial Shield as part of the Settlement.

No. Unless you excluded yourself, you gave up any right to bring a separate action against Morgan Stanley. You must have excluded yourself from the Settlement Class if you wanted to bring a separate action or to be part of any different proceeding relating to the claims in this case.

To exclude yourself, you must have sent a letter that said you want to be excluded from the Settlement in In re Morgan Stanley Data Security Litigation, 1:20-cv-05914-AT (S.D.N.Y.), with your name, address, and signature. You must have mailed your Exclusion Request postmarked by July 12, 2022, to the Settlement Administrator and Class Counsel.

You could not have asked to be excluded on the phone, by email, or on this website.

Yes. The Court appointed the following lawyers as “Class Counsel” to represent all members of the Settlement Class:

Jean S. Martin Morgan & Morgan 201 N. Franklin Street 7th Floor Tampa, FL 33602 1-813-559-4908  jeanmartin@ForThePeople.com

Linda P. Nussbaum Nussbaum Law Group, P.C. 1211 Avenue of the Americas 40th Floor New York, NY 10036 1-917-438-9189  lnussbaum@nussbaumpc.com

You will not be individually charged for these lawyers. If you want to be represented by your own lawyer, you may hire one at your own expense.

The Settlement Agreement does not provide for a specific amount to be paid to Class Counsel, but does allow the Court to award reasonable attorneys’ fees and costs incurred on behalf of the Class to be paid from the Settlement Fund. The Order Awarding Attorneys’ Fees, Reimbursement of Litigation Expenses, and Service Awards to the Named Plaintiffs is available on the Documents section of this website.

You had the opportunity to object to the Settlement if you did not like it or some part of it. The Court would have considered your views. To do so, you must have filed a written objection in this case, In re Morgan Stanley Data Security Litigation, 1:20-cv-05914-AT (S.D.N.Y.), with the Clerk of the Court and mailed a copy of your objection to Class Counsel and Counsel for Morgan Stanley, postmarked no later than July 12, 2022.

Any objectors who wished to speak at the hearing should have notified the Court by July 22, 2022.

These deadlines have now passed. The Final Approval Hearing was held on August 5, 2022, where the Settlement was granted Final Approval.

Objecting is telling the Court that you do not like something about the Settlement and why you do not think it should be approved. You can object only if you do not exclude yourself from the Settlement Class. Excluding yourself is telling the Court that you do not want to be part of the Settlement. If you excluded yourself, you could not object to the Settlement because the case no longer affected you. Please note, the deadline to exclude yourself and to object to the Settlement have both passed.

The Court held a Final Approval Hearing at 9:30 am ET on August 5, 2022, via teleconference.

At this hearing, the Court considered whether the Settlement is fair, reasonable, and adequate and, ultimately, granted Final Approval.

The Settlement Effective Date occurred on November 10, 2022.

The Final Approval Hearing took place on August 5, 2022. You were not mandated to attend.

The Final Approval Hearing took place on August 5, 2022.

If you do nothing, you will get no money from this Settlement, but Settlement Class Members are entitled to access Financial Shield for a period of at least 24 months from the Effective Date of the Settlement.

You must have excluded yourself from the Settlement if you want to retain the right to bring a separate action against Morgan Stanley relating to the Data Security Incidents. The deadline to do so has already passed.

If you received an email from noreply@epiqpay.com, it is because you were determined to be eligible for a payment in a class action settlement. By default, individuals eligible for payments will receive a prepayment notification email a few days before they receive an email containing a link to claim their payment. This is normal. If you claim a payment, you will also receive one or more follow up emails from our payment partner, Tremendous, confirming where in the process your payment is. If you do not immediately claim your payment, you may also receive one or more reminder emails.

If you received an email from rewards@reward.tremendous.com, this email is legitimate. You received this email as you elected a payment option that uses Tremendous, one of our third-party payment partners, to process your payment and notify you of your payment status.

EpiqPay is the official digital payment platform for Epiq Class Action and Claims Solutions. EpiqPay offers individuals who are eligible to receive payments in mass actions an easy, convenient, fast, and secure way to claim their payments. General information about EpiqPay is available at https://www.epiqglobal.com/en-us/technologies/epiq-pay.

Claiming your EpiqPay payment is simple and easy. All EpiqPay payment and reminder emails contain a ‘Claim Payment’ link. As long as you click the ‘Claim Payment’ link before the payment expiry date listed in your email, the link will take you to a payment dashboard where you can choose your preferred method of payment. Then click your preferred payment method. Depending on the method of payment you choose, you may be asked to confirm your selection or provide one or two pieces of information so your payment can be processed. After that, you will receive a small number of interim notifications from our payment partner rewards@tremendous.com letting you know your payment is ‘in process’, and eventually you will receive a link to your payment card, if you chose that as your option. Contact information for our payment partner is available on these notifications, in case you experience any issues using you card.

Emails regarding digital payments for this matter commenced on December 9, 2022, and digital payments will be available to claim through January 23, 2023. During that window, Epiq digital payment emails were or will be sent from noreply@Epiqpay.com, so please review your inbox for messages from that email address. Due to variability in individual recipient email account SPAM and junk security settings, users are encouraged to review their junk and SPAM folders in case the digital payment emails went to those locations.

No. Digital payments are processed quickly, but once a user selects their preferred payment option, it typically takes 2-5 business days for the value of the award to reach end user cards or accounts. Upon making your selection, you will start to receive a series of emails from EpiqPay and our digital payment partners, which will keep you apprised of the progress of your payment.

This website only provides a summary of the proposed Settlement. You are urged to review the complete details about the Settlement which can be found in the Settlement Agreement and other Court Documents, available here. You also may write with questions to the Settlement Administrator at info@MorganStanleyDataSecuritySettlement.com or call the toll-free number, 1-855-604-1744.

Please do not contact the Court or Morgan Stanley regarding the Settlement.