AT&T and Verizon were penalized millions of dollars for what the agency said was a failure to protect consumer information.