Facebook announced late on Friday that it was suspending Strategic Communication Laboratories (SCL) and its political data analytics firm Cambridge Analytica – the data analytics firm that worked with Trump’s election.

The move came a few hours before The Guardian and The New York Times reported on Saturday that SCL and Cambridge had surreptitiously harvested data from about 50 million Facebook accounts. The social network maintains that Cambridge violated Facebook’s rules, but all of that collected personal data did not come from a hack.

Until the middle of 2014, Facebook allowed apps to abuse a loophole to collect personal data on a user’s entire friend network. In this case, an app not only harvested data from the person using the personality quiz app called thisisyourdigitallife, created by UK academic Aleksandr Kogan, but also delved into that person’s friends network and harvested all of their Facebook profile data as well. Facebook claimed only 270,000 people downloaded that app, but Kogan managed to obtain data from 50 million accounts without their consent; of those, enough data had been harvested from 30 million for Cambridge to create psychographic profiles on them.

Facebook removed Kogan’s “research” app in 2015 and demanded for users’ collected data to be destroyed. Yet several sources have confirmed that the data was not destroyed in 2015.