Target is due to pay $18.5 million to 47 states as part of a settlement over a 2013 data breach that affected 41 million people. The breach compromised consumers' credit and debit card information. The investigation concluded that cyberattackers gained access to Target's system using credentials obtained from a third party in Nov. 2013. The hackers were able to obtain full names, phone numbers, and payment information of shoppers.