Morgan Stanley agreed to pay $6.5 million as part of a settlement with six states requiring the firm to strengthen its data security after actions it took compromised the personal data of millions of customers.

Morgan Stanley Smith Barney, the wealth and asset management arm of Morgan Stanley, failed to encrypt the personal data of customers it kept stored on servers and hard drives, according to the agreement the firm reached with the attorneys general of Connecticut, Florida, Indiana, New Jersey, New York, and Vermont.

In 2016, when the firm shut down two data centers, it didn’t take appropriate measures to secure the hard drives and servers. They were eventually auctioned off by movers the firm hired.