On the same day that the Morgan Stanley FINRA AWC was issued, New York Attorney General Letitia James and a coalition of five attorneys general today reached a $6.5 million Agreement https://ag.ny.gov/sites/default/files/settlements-agreements/morgan-stanley-aod.pdf with Morgan Stanley Smith Barney LLC ("Morgan Stanley") for compromising the personal information of millions of customers nationwide.Attorney General James and Multistate Coalition Secure $6.5 Million from Morgan Stanley for Failing to Protect Customer Data / Morgan Stanley to Pay New York $1.6 Million for Compromising the Personal Information of 1.1 Million New Yorkers (NYAG Release / November 16, 2023)
https://ag.ny.gov/press-release/2023/attorney-general-james-and-multistate-coalition-secure-65-million-morgan-stanley

As alleged in part in the NYAG Release;

Morgan Stanley hired a moving company with no experience in data destruction services to decommission thousands of hard drives and servers containing sensitive information of millions of its customers. Morgan Stanley failed to properly monitor the moving company’s work, and its computer equipment, some of which still contained private consumer information, was then sold at auction. Morgan Stanley was only made aware of the problem when a purchaser discovered the data and called the company.

In a second incident, Morgan Stanley discovered during a decommissioning process that 42 servers, all potentially containing unencrypted customer information, were missing. During this process, the company learned that the local devices being decommissioned may have contained unencrypted data due to a manufacturer flaw in the encryption software. The multistate investigation found that Morgan Stanley failed to maintain adequate vendor controls and hardware inventories, and that had these controls been in place, both data security events could have been prevented.

I carefully read and re-read the 19-page Agreement and, gee, I can't find anything about extraordinary cooperation. I do note that Morgan Stanley self-reported the two incidents in July 2020 but the state regulators just don't seem as empathetic or charitable as the self-regulatory-organization FINRA. Perhaps we have uncovered a key difference when the regulation of Wall Street is undertaken by government regulators versus those who do their jobs at an industry self-regulatory-organization.