SEATTLE (AP) — Premera Blue Cross, the largest health insurer in the Pacific Northwest, has agreed to pay $10 million to 30 states following an investigation into a data breach that exposed confidential information on more than 10 million people across the country.

The settlement comes several weeks after Premera said it would spend $74 million to settle a federal class-action lawsuit on behalf of affected customers.

The states said auditors had alerted Premera to the vulnerabilities in its system, including that it was slow to install software updates and security patches, but it failed to fix them.

During the breach, which lasted from May 2014 to March 2015, hackers had access to sensitive data — including medical records, bank account information and Social Security numbers — for 10.4 million people, the majority of them in Washington.

Premera is based in Mountlake Terrace, a north Seattle suburb.