Morgan Stanley accidentally shared an internal investment-banking document containing details of more than 100 potential deals across Asia with clients, exposing information about transactions the bank was pursuing or tracking, Bloomberg reported on Wednesday.
The document included potential initial public offerings (IPOs) in India, China and South Korea, along with details of private-equity firms and pension funds backing some of the companies. It also contained transactions that had been put on hold, bringing a broad range of prospective deals into view.
The accidental disclosure involved sensitive information from Morgan Stanley’s investment-banking pipeline, including certain details that could be price-sensitive.
Morgan Stanley Executive Sent the Wrong File to Clients
According to people familiar with the matter, the document was sent by Mohamed Atmani, Morgan Stanley’s Asia-Pacific head of financial sponsors in its investment-banking division.
Atmani, a Hong Kong-based managing director who joined the bank in 2018, had intended to send clients a different presentation. The planned document contained general information about the private-equity industry and recent transactions.
Instead, an internal deal pipeline file was sent to recipients. Atmani subsequently attempted to recall the email after the mistake was identified.
The document primarily focused on Asia, but its contents extended beyond the region to include potential deals in Europe, the Middle East and Africa. A blurred version of the list was later posted on Instagram, adding another dimension to the disclosure.
India IPOs Among the Potential Deals Exposed
The document’s inclusion of potential IPOs in India, China and South Korea makes the incident particularly notable for investors tracking upcoming public listings across Asian markets.
Beyond IPO candidates, the file reportedly identified financial backers associated with some of the companies, including private-equity firms and pension funds.
It also included transactions that were on hold, suggesting that the document covered deals at different stages of consideration rather than only those moving towards completion.
However, the inclusion of a company or transaction in the internal pipeline does not establish that a deal will proceed. The disclosed information concerned potential transactions that Morgan Stanley was pursuing or tracking.
Morgan Stanley Responds to the Accidental Disclosure
Morgan Stanley acknowledged the incident and said it had moved quickly to address the inadvertent sharing of information.
“We promptly took steps to address this inadvertent sharing of information, and we continue to engage with relevant parties,” the New York-based bank told Bloomberg.
The statement indicates that the bank took steps after the document was mistakenly distributed. However, the information provided does not establish whether any of the potential transactions were subsequently affected by the disclosure.
Morgan Stanley has long been a leading underwriter of Hong Kong stock sales and a major participant in mergers and acquisitions across Asia, making the confidentiality of its investment-banking pipeline an important part of its business.
Financial Institutions Face Continued Data-Security Scrutiny
The Morgan Stanley incident comes against the backdrop of other data-security problems involving financial institutions.
In May 2019, a cybersecurity weakness at a unit of First American Financial exposed 885 million documents containing customer information.
The issue later attracted regulatory scrutiny. In November 2023, New York’s top financial regulator fined the company $1 million for concealing the cybersecurity flaws.
While the First American case involved a cybersecurity weakness and the Morgan Stanley incident stemmed from an accidental email disclosure, both cases highlight how sensitive financial information can become exposed through failures in information security and handling.
For Morgan Stanley, the immediate issue was the unintended distribution of an internal deal pipeline that included potential IPOs and other transactions across multiple regions. The bank said it had taken prompt steps to address the incident and was continuing to engage with the relevant parties.
Also Read: Apple’s $250 Million Siri Settlement: Check If Your iPhone Qualifies
