Auto insurance companies GEICO and The Travelers Indemnity Co. agreed to pay a combined $11.3 million in state penalties for data-security breaches that resulted in a compromise of more than 120,000 New Yorkers’ personal information, multiple state agencies said on Monday.

GEICO—the Government Employees Insurance Company—will pay $9.75 million in penalties and Travelers will pay $1.55 million, said New York Attorney General Letitia James and Department of Financial Services Superintendent Adrienne A. Harris, whose offices joined the state Department of Labor in the multi-agency probe.