A broker-dealer of Empower Retirement must pay $1.5 million to the U.S. Securities and Exchange Commission for failing to file hundreds of suspicious-activity reports despite knowing that bad actors were hacking, or attempting to hack, customer accounts, the agency announced Wednesday.