A coalition of seven states—including New York, New Jersey and Connecticut—announced a $2 million settlement Friday with CafePress Inc. over a data breach that compromised the personal information of 22 million consumers nationwide.