Forty-one attorneys general—including from Pennsylvania, Florida, Georgia, New York, Connecticut, Texas and New Jersey—announced Thursday they have settled a data breach case against a debt collection agency that potentially exposed the personal information of up to 21 million individuals.

As part of the settlement agreement between the states and Retrieval-Masters Creditors Bureau, which does business as American Medical Collection Agency or AMCA, the company might be liable for upward of $21 million.