Eddie Bauer agreed to a settlement with Iowa-based Veridian Credit Union over a class action lawsuit related to a 2016 data breach, according to documents filed in the U.S. District Court for the Western District of Washington. The retailer admitted no wrongdoing in the filing.

In all, the company could expend some $9.8 million, according to the documents. A minimum of $1 million and a maximum of $2.8 million will be paid by Eddie Bauer in settlement distributions, plus up to $2 million to cover attorney fees and other costs, according to the filing. The retailer further expects to spend about $5 million taking steps to ensure that its payment and cybersecurity systems are safe, according to the agreement.