Morgan Stanley staffer cops guilty plea over data breach

Data leaked because Marsh was hacked, says lawyer

The Morgan Stanley staffer fired in January over a massive data breach has now entered a guilty plea in the Federal Court in Manhattan.

Galen Marsh was being tried for taking hundreds of thousands of records of the bank's wealth management operation home. Some of the trove, affecting 900 individuals, then ended up on Pastebin as a pitch for the sale of the whole data set.

While early reports said six million accounts were offered for sale, complete with passwords (something Morgan Stanley denied in a statement), the prosecution's case said Marsh took a more modest 730,000 records away from the bank, affecting about 350,000 customers.

Morgan Stanley has reiterated that customers did not lose any money from the disclosure.

Defense attorney Robert Gottleib said Marsh never posted the information online. Rather, Gottleib told the court, the disclosures “were the result of outside hackers, and he had absolutely nothing to do with it”.

The feds might even agree: a source told Reuters authorities are still looking into “other aspects of the breach”.

Marsh worked with Morgan Stanley from 2008, when he began as a sales assistant. The data in this case was copied to his home computer between 2011 and 2014.

While his lawyers hope Marsh won't get time in the slammer, his plea deal includes not appealing any prison term less than 37 months. ®