State paying for Commerce Department data breach