FIIG penalised $2.5m for cyber security failures