The announcement came Monday, after MLB completed its investigation regarding the breach of the Astros' baseball operations database by a former Cardinals' employee, scouting director Chris Correa.
Correa will be placed on the "permanently ineligible list," effective immediately, also per orders of MLB commissioner Rob Manfred. The $2 million is to be paid within 30 days.
"We respect the Commissioner's decision and appreciate that there is now a final resolution to this matter," Cardinals chairman and CEO William O. DeWitt Jr. said in a statement. "Commissioner Manfred's findings are fully consistent with our own investigation's conclusion that this activity was isolated to a single individual."
"This has been a long and challenging process for all of us, especially those within our baseball operations department," Cardinals GM John Mozeliak said in the statement. "We have learned a great deal along the way and we have taken additional steps to ensure that something like this doesn't ever happen again."
The Astros also issued a statement, saying they support the ruling and penalties.
"This unprecedented award by the Commissioner's Office sends a clear message of the severity of these actions," the statement said. "Our staff has invested a great deal of time in support of the government, legal and league investigations and are pleased to have closure on this issue."
The MLB Department of Investigations conducted the review, and the results were submitted to Manfred.
On Jan. 8, 2016, Correa pleaded guilty in federal court to five counts of unauthorized access of a protected computer for intruding into the Astros' email system and analytical scouting database in 2013 and 2014, following an FBI investigation. On July 18, 2016, the court sentenced Correa to 46 months in federal prison and ordered him to pay the Astros $279,038.65 as restitution. The Cardinals fired Correa in 2015 after their own internal investigation.
A Houston judge last week unsealed documents from Correa's case that illustrated the "unfettered access" he had to Houston's internal databases. Though portions of the documents remained redacted, they show Correa intruded in the Astros' "Ground Control" database 48 times and accessed the accounts of five Astros employees over a 2½-year period starting in January 2012.
The Cardinals have maintained that Correa was acting alone and kept the details of his illegal findings to himself, and Manfred said Monday he had found no evidence that any other Cardinal employees knew of Correa's actions.
Nonetheless, Manfred said he found the team "vicariously liable" for Correa's misconduct.
"The conduct is contrary to everything the Cardinal organization is about," Mozeliak said later Monday. "No one in the Cardinal organization directed or authorized him to access the Astros' data base or knew he was viewing Astros' confidential and proprietary information."
He also said he had conversations with Astros owner Jim Crane and GM Jeff Luhnow early in the investigation.
"Obviously I was embarrassed for what happened," he said. "Certainly when I look back it, it's not something we'll ever be proud of and it is disappointing it happened. Once the investigation got moving and you understood federal authorities were involved, it is not something we were having on-going discussions on."
Correa looked at the Astros' medical evaluations of possible draft picks, internal scouting reports and trade discussions with other teams.
ESPN's Mark Saxon contributed to this report.