MINNEAPOLIS – Target Corp. will pay banks and credit unions $39.4 million to resolve a class-action lawsuit triggered by the retailer’s data breach in 2013, the Fiscal Times reports. As many as 70 million people might have had personal data—including email addresses and phone numbers—compromised because of the security violation.

The settlement requires Target to pay around $20.25 million to credit unions and banks, with an additional $19.11 million to MasterCard Inc. for card reissue expenses. U.S. District Judge Paul Magnuson approved the deal in a preliminary hearing. Final approval will come in May 2016. This comes on the heels of an agreement Target reached earlier in 2015 with Visa Inc., with the discount merchant paying about $67 million to Visa and $10 million to customers.

“Financial institutions should not always have to bear the burden of extensive costs related to merchant data breaches over which they have no control,” the plaintiffs’ lawyers said in a statement.

As a result of the data breach, Target has become more proactive in data security, becoming one of the first U.S. merchants to add chip-readers at all locations.