Hackers accessed "personally identifiable data" of the firm's customers, financial professionals and staff.