A state regulator publicly released confidential information on thousands of customers of Morgan Keegan & Co., the investment banking and brokerage firm, the Wall Street Journal reported.
Alabama's securities regulation agency "mistakenly released" the information, forcing the Memphis firm to notify some 18,500 account holders of the breach of security.
The information was released as part of a probe into subprime investments sold by Morgan Keegan.
The customer information existed in a spreadsheet, the Journal reported, and included highly sensitive information such as the account holder's name, tax identification, a range of annual income and net worth and the losses the clients incurred.
The data was delivered to a Birmingham securities attorney.
Morgan Keegan clients allegedly lost some $2 billion in investments in Morgan Keegan mutual funds that invested in subprime securities, a subject of the probe.
This week, Morgan Keegan began notifying account holders of the "unauthorized" breach. In its letter to customers, Morgan Keegan said it wasn't aware of misuse of the information and it offered a free credit-monitoring service, the Journal reported.
In April, the Securities and Exchange Commission charged Morgan Keegan and two employees with fraud, alleging they manipulated the prices of the subprime funds suffering steep losses. The Alabama Securities Commission initiated its own administrative action and requested from Morgan Keegan the confidential customer data.
Morgan Keegan said it had been required by law to turn over the information and that it did so "in reliance upon state law that prohibits unauthorized disclosure and use of this information, and only after we obtained assurances that this information would be treated as confidential."