Facebook has found themselves in the midst of another data mining scandal. New York’s attorney general has announced she will be opening up an investigation into Facebook’s unauthorized collection of 1.5m users’ email address contacts, which could have left hundreds of millions of people’s private information exposed.

According to Business Insider, which revealed the practice last week, Facebook harvested the email contacts for 1.5m people who joined the social networking site after 2016. Facebook then planned to use those contact lists to improve ad-targeting algorithms and friend recommendations across its platform.

“Facebook has repeatedly demonstrated a lack of respect for consumers’ information while at the same time profiting from mining that data,” said Letitia James, the attorney general of New York. “It is time Facebook is held accountable for how it handles consumers’ personal information.”

Facebook responded by saying the harvest was “unintentional”, and that it was a result of a former method of verification the website used prior to 2016. According to Facebook, users were previously required to enter their email passwords to verify their identities upon registration, a process that has been discontinued for three years.

Facebook did not make any users aware that their information had been collected, and only stopped the harvesting method after the press had discovered what was happening. According to sources close with the matter, Facebook is already in talks with officials.

“We’re in touch with the New York State attorney general’s office and are responding to their questions on this matter,” a spokeswoman for Facebook said.