Morgan Stanley has settled claims by the Office of the Comptroller of the Currency (OCC) that it failed to properly decommission data centers that housed client data of its wealth-management operations two times—once in 2016 and once in 2019 for $60 million.

According to the OCC, Morgan Stanley “failed to effectively assess or address risks associated with decommissioning its hardware” by subcontracting the work out and failing to identify customer data that was stored on obsolete devices.

Morgan Stanley notified affected customers in July and is offering credit monitoring at no charge to its customers if they sign up by October 31.