Washington State University’s board of regents on Friday authorized lawyers for the school to negotiate a payment of up to $5.26 million to settle a lawsuit over a potential data breach nearly two years ago.

The class-action suit in King County Superior Court stemmed from an April 2017 burglary at an Olympia storage facility in which someone stole a safe containing a hard drive, which in turn contained sensitive information on nearly 1.2 million people, including names, Social Security numbers and personal health records.

The data had been collected by WSU’s Social and Economic Sciences Research Center, which has offices in Pullman and the state capital. The burglary remains unsolved, and it’s unclear if criminals have accessed any of the stolen data, or if they knew they were stealing it in the first place.

Plaintiffs – many of whom were surprised to learn that WSU had their personal information – accused the university of negligence for storing the hard drive in an unsecure location.

The regents’ resolution says a tentative settlement agreement was reached on Wednesday. The final amount could be less than $5.26 million. The payment would come from WSU’s insurers.