T-Mobile US Inc agreed on Friday to pay $350 million and spend an additional $150 million to upgrade data security to settle litigation over a cyberattack last year that compromised information belonging to an estimated 76.6 million people.

The preliminary settlement was filed with the federal court in Kansas City, Missouri.

It requires a judge’s approval, which the second-largest U.S. wireless carrier said could come by December.

T-Mobile denied wrongdoing, specifically, including accusations that it breached its duties to protect customers’ personal information and had inadequate data security.

The Bellevue, Washington-based company expects an approximately $400 million pre-tax charge in this year’s second quarter for the settlement. It said it contemplated the charge and $150 million of spending in prior financial guidance.
T-Mobile disclosed the data breach last August, saying at the time it affected more than 47 million current, former and prospective customers.

The number soon grew past 50 million, and T-Mobile said in November its investigation uncovered an additional 26 million people whose personal information was accessed.

T-Mobile has said the information included names, addresses, birth dates, driver’s license data and Social Security numbers.

Friday’s settlement covered nationwide litigation combining at least 44 proposed class-action lawsuits.

Class members may receive cash payments of $25, or $100 in California, and some could receive up to $25,000 to cover out-of-pocket losses, settlement papers show. They will also receive two years of identity theft protection.

John Binns, a 21-year-old American who had moved to Turkey a few years earlier, took responsibility for the hacking, saying he pierced T-Mobile defenses after finding an unprotected router on the internet, The Wall Street Journal said last August.

The plaintiffs’ lawyers may seek fees of up to 30%, or $105 million, from the settlement, the settlement papers show.