One server was stolen from a branch in Lurgan, County Armagh, in April 2014 and another was lost a month later by a courier firm in Swindon, Wiltshire.
Encryption systems were not good enough to ensure data could not be accessed, the Information Commissioner said.
The company apologised and said it had since reviewed its IT security.
The Information Commissioner's office said the servers, which are still missing, "held large numbers of local and national customer records and employee details".
Under The Money Shop's own rules, servers should have been stored in a separate locked room, but the Lurgan store - and others - did not have rooms available to store them.
It also had a "widespread practice" of moving unencrypted servers between its head office in Nottingham and its branches, the commissioner said. Old customer records were not deleted.
Head of enforcement at the commissioner's office, Steve Eckersley said customers had expected their financial details to be kept safe.
"Our investigations discovered that this wasn't the case and that this information was regularly left exposed when equipment was moved around the country.
"There was potential for fraud and financial loss to customers, which is unacceptable, and in both cases had the data been properly encrypted the damage and distress to customers and the monetary penalty could have been avoided."
Dollar UK, which owns the Money Shop, said: "Since these events took place, Dollar UK has come under new ownership and management, implementing a complete review of IT and systems security, including the replacement of those responsible for managing this essential element of business infrastructure and consumer confidence."
Payday lender The Money Shop has been fined £180,000 after losing computer servers with thousands of customers' financial details.