The lawsuit appears to be the first time the SEC has sued a firm that has been victim of a cyberattack. It has typically charged public companies for inadequate security or misleading disclosures over hacks and data breaches.