Target will pay $18.5 million in settlement with states over 2013 data breach