SEC fines NYSE parent company $10M for failing to report cyberattack