Morgan Stanley will pay six states a combined $6.5 million after an investigation found the financial services company failed to protect customers’ data, compromising the personal data of nearly 3.4 million people nationwide.

The payments resolve investigations with attorneys general offices in New York, New Jersey, Connecticut, Florida, Vermont and Indiana, stemming from two data security incidents reported by Morgan Stanley in July 2020.