The Securities and Exchange Commission has settled charges against a St. Louis investment firm that allowed Chinese hackers to steal data on more than 100,000 clients, even though no financial harm was inflicted upon those clients.

The investment company, R.T. Jones, stored personal identifying information on its clients on a third-party server without taking basic precautions to safeguard it, according to the SEC, which said the company “failed to conduct periodic risk assessments, implement a firewall, encrypt [personal identifying information] stored on its server, or maintain a response plan for cybersecurity incidents.”