More than 540m Facebook records were left exposed on public internet servers, cybersecurity researchers said on Wednesday, in just the latest security black eye for the company.

Researchers for the firm UpGuard discovered two separate sets of Facebook user data on public Amazon cloud servers, the company detailed in a blogpost.

One dataset, linked to the Mexican media company Cultura Colectiva, contained more than 540m records, including comments, likes, reactions, account names, Facebook IDs and more. The other set, linked to a defunct Facebook app called At the Pool, was significantly smaller, but contained plaintext passwords for 22,000 users.

The large dataset was secured on Wednesday after Bloomberg, which first reported the leak, contacted Facebook. The smaller dataset was taken offline during UpGuard’s investigation.

The data exposure is not the result of a breach of Facebook’s systems. Rather, it is another example, akin to the Cambridge Analytica case, of Facebook allowing third parties to extract large amounts of user data without controls on how that data is then used or secured.

“The data exposed in each of these sets would not exist without Facebook, yet these data sets are no longer under Facebook’s control,” the UpGuard researchers wrote in its blogpost. “In each case, the Facebook platform facilitated the collection of data about individuals and its transfer to third parties, who became responsible for its security.”

Facebook said that it was investigating the incident and did not yet know the nature of the data, how it was collected or why it was stored on public servers. The company said it will inform users if they find evidence that the data was misused.

“Facebook’s policies prohibit storing Facebook information in a public database,” a spokeswoman said in a statement. “Once alerted to the issue, we worked with Amazon to take down the databases. We are committed to working with the developers on our platform to protect people’s data.”

Cultura Colectiva did not immediately respond to a request for comment.

The data exposure is just the latest example of how Facebook’s efforts to be perceived as a “privacy-focused” platform are hampered by its own past practices and what UpGuard researchers called “the long tail” of user data. For years, Facebook allowed third-party app developers substantial access to users’ information.

“As these exposures show, the data genie cannot be put back in the bottle,” the UpGuard researchers wrote. “Data about Facebook users has been spread far beyond the bounds of what Facebook can control today.”