The brokerage said the leak resulted from the servers of an external vendor being hacked.