Equifax, the Federal Trade Commission, and other state and federal regulators have agreed on what Equifax owes in penalties, nearly two years after the company’s massive breach of sensitive consumer information became public.

The company will pay at least $575 million, according to the terms of a settlement the FTC announced today. At least $300 million goes into a fund to pay for credit monitoring services for “affected customers,” which includes more than 40% of the entire US population. That fund can get boosted by another $125 million if the initial $300 million isn’t enough to compensate all consumers who make claims.

Equifax will pay another $175 million in fines to be split up among the 50 attorneys general who filed suit, representing 48 states, Washington DC, and Puerto Rico, and $100 million in penalties to the Consumer Financial Protection Bureau.