The luxury department store operator has agreed to pay $1.6 million to settle a suit brought against it for a security breach that exposed credit and debit card data of about 350,000 shoppers in 2013.