Washington D.C.’s attorney general filed a lawsuit against Facebook Wednesday, marking the first large-scale attempt to punish the social-media platform for allowing political-consulting firm Cambridge Analytica to access the private data of tens of millions of unwitting users, The Washington Post reports. “Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used,” Karl Racine said in a statement cited by the Verge. “Facebook put users at risk of manipulation by allowing companies like Cambridge Analytica and other third-party applications to collect personal data without users’ permission. Today’s lawsuit is about making Facebook live up to its promise to protect its users’ privacy.”

The Cambridge Analytica scandal first surfaced this March, when whistleblower Christopher Wylie announced that the firm had taken the data of more than 80 million Facebook users and used that data to create “psychographic” profiles. A federal investigation into Facebook’s relationship with the firm is currently ongoing. An unidentified source told the Post that the lawsuit could later be amended to include the new scandals the company is weathering—including Tuesday’s revelation that more than 150 companies had “special arrangements” with the tech titan to access user data.