According to an order by the SEC, the bank negligently under-reported what it knew about a data breach and ransomware attack it suffered that year.