Twenty-seven state attorneys general—including from New York, New Jersey, Connecticut, Florida and Pennsylvania—announced Wednesday they had reached a $2.4 million settlement agreement with Sabre Corp., whose 2016/2017 data breach exposed the data of owners of about 1.3 million credit cards.

The data breach affected Sabre Hospitality Solutions’ hotel booking system. The booking system, which Sabre Corp. owns, operates the SynXis Central Reservation system that helps facilitate the booking of hotel reservations nationwide.