Penalty relates to cybersecurity failures which exposed personally identifiable information of tens of thousands of customers ...