On Wednesday, a new chapter was added to the seemingly never-ending story of Facebook privacy snafus when the social media giant admitted that the email contacts of up to 1.5 millions users were “unintentionally uploaded to Facebook when they created their account.”

Ironically, the discovery was made when the company reviewed the verification process for new users as the result of another privacy blunder. Earlier this month, an independent security researcher called out Facebook for requiring some new users to verify their identity by providing the password to their email address, an abysmal practice from a security standpoint. Facebook responded by deleting this step and reviewing the verification process, which brought to light the latest debacle.

Facebook claims that the millions of email contacts were “not shared with anyone” and will now be deleted. Affected users have been notified.

Read more: Facebook uploaded 1.5 million people’s email contacts without permission