Retail giant Target has agreed to pay a total of $18.5 million in a settlement with Florida and 46 other states over a 2013 consumer data breach that resulted in over 100 million pieces of credit card or personal information being stolen by hackers.

The settlement Tuesday came after a multi-state investigation led by the offices of the Connecticut and Illinois attorneys general. That investigation determined hackers accessed Target’s gateway server using credentials stolen from a third-party vendor, according to statements from the participating states.