SEC nails advisory firm for cybersecurity failure before data breach