Social media company Twitter announced it was being probed by the Federal Trade Commission (FTC) for allegedly using people’s data for targeted advertising, warning it could face fines of between $150 million to $250 million.

In an SEC filing, Twitter said it had received a complaint from the FTC, relating to the use of phone numbers and email address data provided for safety and security purposes for targeted advertising during periods between 2013 and 2019.

The company asks users to provide phone numbers for two-factor authentication as part of its sign-up process, ensuring people receive a text message before they can access their accounts.

However, these numbers remained in its system to allow advertisers to tailor ads, using the numbers. Twitter could not clarify how many users were affected.

Twitter stated it would face a “probable loss” of $150 million to $250 million and had already recorded the former estimate in accrual, adding there was no assurance on the timing or the terms of any final outcome.

The probe comes at a tumultuous time for the company.

Last month, it was hit by an attack in which 130 high-profile accounts were effected, exposing personal data and messages.