Hard disk drives (HDDs) come with a finite lifespan, emphasizing the importance of secure disposal to safeguard your company’s integrity. Neglecting the proper disposal of end-of-life (EOL) equipment can result in a data breach, potentially inflicting lasting damage on your business.
Let’s draw insights from a significant data disaster back in 2016 involving Morgan Stanley, a multinational investment firm. During the decommissioning of IT assets, the firm entrusted the process to Triple Crown, a moving and storage company. Regrettably, Triple Crown failed to properly sanitize the EOL hard drives before passing them to a third party, leading to a data breach exposing the personal information of 15 million customers. The breach went undetected for almost a year, triggering customer notifications, SEC involvement, and a hefty $35 million fine.
The SEC investigation underscored three critical issues:
- Failure to establish and enforce procedures for the proper disposal of customer information.
- Inadequate vetting of service providers to ensure expertise in safe data disposal.
- There is a need for more due diligence on the service provider’s ability to dispose of hard drives containing sensitive data.
2019 Morgan Stanley encountered additional data protection challenges when it retired 500 servers nationwide. The inability to account for specific devices containing encrypted data resulted in a $60 million fine from the OCC in 2020 and an additional $60 million settlement from a class action lawsuit later that year.
To navigate these potential pitfalls, take specific measures to protect customer information:
- Establish a data destruction process: Consider shredding hard disk drives to eradicate 100% of the data, adhering to security requirements set by the National Security Agency and the Department of Defense.
- Establish a verification plan: Ensure regulatory compliance by implementing a verification process emphasizing accountability and generating a comprehensive audit trail.
- Rely on e-recycling professionals: Partner with Ecycle Atlanta for computer & electronics Recycling, which offers cutting-edge hard drive data destruction services at no cost.
Maintaining trust is paramount in a world where customers entrust sensitive personal information to companies. The challenges faced by Morgan Stanley offer valuable lessons. Even smaller companies with varying scales of operation must prioritize EOL data security to shield against potential financial penalties and reputational harm.
