The company, which is led by Republican presidential nominee Donald Trump and three of his children, manages a number of hotels around the world under the Trump Hotel Collection name.

According to Schneiderman, bank analyzes of hundreds of fraudulent credit card transactions in May 2015 found Trump Hotels was the last merchant where a legitimate transaction took place. An investigation turned up malware in computer systems associated with Trump hotels in New York, Las Vegas and Chicago.

Another breach was reported to Trump Hotels in March, Schneiderman said. Investigators found credit card malware had been put on 39 systems affecting five hotel properties, including Trump SoHo New York.

Get Data Sheet, Fortune’s technology newsletter.

Trump Hotels violated New York law by not providing notice of the breaches to consumers as soon as possible, Schneiderman said. After learning about malware in 2015, it took some four months for the company to put a notice about it on its website, he said.

Aside from the $50,000 penalty, the settlement requires Trump Hotels to beef up its data security policies.

“Unfortunately, cyber criminals seeking consumer data have recently infiltrated the systems of many organizations including almost every major hotel company,” a Trump Hotels spokesperson said. “Safeguarding our customers’ data is a top priority for the company and we will continue taking actions to do so.”

Donald Trump Is Disenfranchising the #1 Customer in America

Schneiderman is also looking into other Trump activities. In 2013, he filed a fraud lawsuit against Trump over his Trump University series of real estate seminars.

More recently, Schneiderman has announced a probe into whether Trump’s charitable foundation abided by New York non-profit laws. Trump has claimed the moves by Schneiderman, a Democrat who is backing Hillary Clinton for president, are politically motivated.