Uber on Wednesday agreed to pay a record $148 million in state and local penalties to settle allegations that the company intentionally concealed a major data breach in 2016 that exposed the personal information of 57 million people—including a $3.75 million share for New Jersey.

The settlement comes in the wake of a multistate investigation that found the ride-hailing company paid hackers $100,000 to conceal the breach, which exposed the names, email addresses, and cellphone numbers of those users. Uber did not provide public notice of the breach until a year after it happened in late 2016.

New Jersey was on the multi-jurisdictional investigation's executive committee, according to a release from New Jersey Attorney General Gurbir Grewal's Office.

“This is a significant settlement for New Jersey residents and for Uber users everywhere—not only because the payout is historic, but because it requires that Uber adopt new policies and procedures that will more effectively safeguard the personal information of its riders and drivers in the future,” Grewal said in a statement. “We're also sending a signal to other companies that ignoring consumers' privacy rights comes with a stiff financial penalty.”

The settlement is between Uber, all 50 states, and the District of Columbia.

The company's board of directors were in the dark about the ransom payment until it was discovered by a law firm last spring. The firm was hired to investigate the company's security team in a separate matter but stumbled on the breach during its inquiry. The board then hired a forensic firm to probe what happened with the breach.

Uber said in a November 2017 statement from CEO Dara Khosrowshahi that the breach was carried out by two hackers outside the company. The hackers accessed user data on a third-party, cloud-based service the company uses to store some information. They, however, were not able to download users' Social Security numbers, bank account information, credit card numbers, dates of birth, and trip history, according to the company.

The hackers were able to collect the names, email addresses, and cellphone numbers of the 57 million people that use Uber and the driver's license numbers of about 600,000 drivers, according to the company.

Uber eventually provided notice of the breach after an investigation, but that wasn't until a year after the breach and ransom payment happened. 

Uber is based in San Francisco. California's share of the settlement is $26 million, which it will split with the San Francisco district attorney's office. DA George Gascon, who has frequently scrutinized Uber's business practices, joined the investigation into the data breach.

Becerra said Uber violated California laws requiring companies to secure customers' information and to promptly report data breaches affecting more than 500 people to the state Department of Justice. More than a quarter of the 600,000 Uber drivers who had their data exposed live in California.

The money will pay for more consumer enforcement actions, Becerra said.

“Anyone thinking about trying to evade the law, to skirt their responsibility to inform the public or law enforcement that a data breach has occurred … they better report it,” Becerra said. “Don't think that you can hide it and get away with it. You will find yourself in the same position as Uber did.”

Uber Chief Legal Officer Tony West said in a statement on Wednesday that they are working to improve safety and security after the breach and have hired new experts to implement those improvements. He said the company learned from its mistake in 2016. “Our current management team's decision to disclose the incident was not only the right thing to do, it embodies the principles by which we are running our business today: transparency, integrity, and accountability,” West said. “An important component of living up to those principles means taking responsibility for past mistakes, learning from them, and moving forward.”

The company's notice in 2017 launched a nationwide investigation into its conduct in the wake of the breach. California is one of several states that independently investigated the breach before teaming up with other states on the probe.

Uber has also promised to develop a new policy on data security that will assess the potential risk of another breach and implement improvements beyond what's currently in place. The company is required to hire an outside contractor to examine its security efforts regularly and recommend improvements.

Uber will also have to take additional precautions to protect any user data it stores on third-party platforms, such as the one hackers accessed in 2016. If there is another breach, employees must also have an avenue to report any ethics concerns they have about other employees. Those employees will also now be subject to stricter password guidelines to gain access to the company's internal network.

The settlement does not resolve any liability that Uber may have to consumers, Becerra said. Uber is still litigating claims related to the breach in multidistrict litigation before U.S. District Judge Philip Gutierrez in the Central District of California.