AG Josh Shapiro reaches settlement with Expedia and Orbitz in 2018 data breach