When A Misdirected Email Becomes A Data Breach: Lessons From The Morgan Stanley Deal-List Leak

A banker reportedly attached the wrong file to a routine client email. The file was Morgan Stanley’s internal deal pipeline, more than a hundred transactions the firm was running or watching across Asia and beyond. His attempt to recall the email was unsuccessful and rival bankers were soon saying they would use the list to chase the same deals while regulators in three jurisdictions had begun asking questions.

The firm met the clients whose deals were named, told staff to keep the list off their own devices and ran training built around the misdirected email in particular. Securities and Exchange Board of India (“SEBI”) began looking at whether its rules were touched and Hong Kong and mainland China noticed too. The incident also raises questions about the legal consequences of an email sent in error.