Biotech company hacked in 2023 pays states $4.5 million over breached data