Morgan Stanley will pay six states a combined $6.5 million after an investigation found the financial services company failed to protect customers' data, compromising the personal data of nearly 3.4 million people nationwide.