The owners of T.J. Maxx and Marshalls have agreed to may millions of dollars to states after a data breach placed customers' personal financial information at risk.

TJX will pay $9.75 million to North Carolina and 40 other states, and increase security so the breach can't happen again.

North Carolina Attorney General Roy Cooper says the breach happened when criminals were able to hack into the company's computer system and steal tens of millions of credit and debit card numbers. Copper says TJX did not have enough safeguards in place to protect consumers from the attack.

Under the agreement, the company must upgrade wireless systems in stores to make them less vulnerable to hackers, use firewalls and other measures to separate consumers' personal information from the rest of its computer system, and implement proper security password management for parts of the computer system that store, process or transmit that personal data.