Ride-sharing giant Uber violated Pennsylvania’s consumer protection law when it failed to promptly disclose that a data breach occurred in late 2016, and that mistake should cost the company at least $13.5 million, state Attorney General Josh Shapiro has claimed in a newly filed lawsuit.

Shapiro filed a lawsuit Monday in the Philadelphia Court of Common Pleas, alleging that Uber violated Pennsylvania’s Breach of Personal Information Notification Act when it waited more than a year to announce that it had been hacked in November 2016. According to the complaint, at least 13,500 Pennsylvania Uber drivers had their driver’s license information accessed as a part of the breach.