TikTok’s parent company ByteDance fired one executive and another resigned after it was revealed the Chinese tech giant tracked journalists. An internal investigation by ByteDance found employees wrongfully obtained the data of certain U.S. users, including their IP addresses. 

The company claimed internal auditors were trying to find the source of suspected leaks, according to materials reviewed by Forbes. The journalists they tracked worked for Forbes, Buzzfeed, and the Financial Times, organizations that have all written stories based on private, internal documents. 

“The misconduct of certain individuals, who are no longer employed at ByteDance, was an egregious misuse of their authority to obtain access to user data. This misbehavior is unacceptable, and not in line with our efforts across TikTok to earn the trust of our users,” TikTok spokesperson Hilary McQuaide told Forbes.

The tracking began after BuzzFeed News published a story stating it had obtained recordings of internal company meetings that revealed ByteDance employees in China had accessed user data in the U.S.

All of the employees involved in what was called Project Raven were fired by the company. Two were located in China while the other two were in the United States.

“I was deeply disappointed when I was notified of the situation … and I’m sure you feel the same. The public trust that we have spent huge efforts building is going to be significantly undermined by the misconduct of a few individuals,” ByteDance CEO Liang Rubo said in an email to employees.

TikTok said it’s in the process of moving U.S. customer data to an Oracle cloud, but historical data is still available on ByteDance’s Chinese servers. The company has repeatedly claimed it plans to delete that historical data.

In recent years, critics of TikTok have warned that members of the Chinese Communist Party could get access to Americans’ data. TikTok has an estimated 100 million users in the U.S. A number of states have banned the app from government issued devices.