Forty-one attorneys general—including from Florida, Georgia, Pennsylvania, New York, Connecticut, Texas and New Jersey—announced Thursday they have settled a data breach case against a debt collection agency that potentially exposed the personal information of up to 21 million individuals.