CHICAGO (AP) — Uber has agreed to pay $148 million and take steps to tighten data security, after the ride-hailing company failed for a year to notify drivers that hackers had stolen their personal information.

Illinois Attorney General Lisa Madigan announced the settlement Wednesday between Uber Technologies Inc. and all 50 states and the District of Columbia.

READ MORE: Weeks After Deadline, Still No Deal For Frontline Worker Pay

Uber learned in November 2016 that hackers had accessed personal data, including driver’s license information, for roughly 600,000 Uber drivers in the U.S. The company acknowledged the breach in November 2017, saying it paid $100,000 in ransom for the stolen information to be destroyed.

READ MORE: Where Have All The Workers Gone? And When Are They Coming Back?

The states sued Uber, saying the company violated laws requiring it to promptly notify people affected by the breach.

MORE NEWS: Former Chief Public Defender Mary Moriarty Announces Campaign For Hennepin County Attorney

Madigan says “Companies cannot hide when they break the law.”