Target said it will pay $18.5 million to 47 states and the District of Columbia as part of a settlement over a 2013 data breach.