Morgan Stanley Employee Exposes Data in Email Error
Morgan Stanley has confirmed the inadvertent disclosure of an internal deal list after an employee mistakenly sent the document to clients. The file contained information on more than 100 investment-banking deals and projects, primarily in Asia.
The incident became public on September 23, 2026. The document included potential IPOs in China, South Korea and India, as well as mergers and acquisitions and large block trades. According to Reuters, the September 21 deal list included around 60 active transactions, more than 50 projects at the pitching stage and nearly 30 projects that had been put on hold.
The document also contained information on:
- Private equity;
- Venture capital
- Pension funds
Associated with companies on the list. It did not disclose detailed deal terms, and some of the projects were already publicly known.
The internal file was mistakenly attached to a weekly email intended for clients. After realizing the mistake, the employee sought to recall the message, apologized and asked recipients to delete the attachment and not distribute it further.
A blurred copy of the document later appeared on Instagram. Morgan Stanley said it takes client confidentiality seriously, promptly took steps to address the incident and continued to engage with the relevant parties.
The incident is a classic example of an accidental data leak caused by human error. Such mistakes are difficult to eliminate completely. Employee training and security awareness can reduce the risk, but they cannot fully account for inattention, fatigue or accidental actions. This is where technical safeguards become important. SearchInform’s Next-Gen DLP Risk Monitor classifies sensitive data and applies predefined security policies to prevent its leakage. For example, organizations can completely block information related to financial deals from being sent to external recipients. Such policies help prevent confidential data from leaving the organization even when an employee attaches or sends it by mistake.
ABOUT SEARCHINFORM
SearchInform is an information security and risk management product vendor as well as an MSS provider. The company's clients are more than 4000 companies in 20+ countries. Today, the team has products and services for comprehensive protection against insider threats at all levels of corporate information systems: FileAuditor (the DCAP class solution); DLP system with extended functionality; Risk Monitor (advanced platform for internal threat mitigation); SIEM system, Information Security outsourcing service.
