Amazon is conducting an internal investigation into allegations that its staff in China received bribes from merchants for user data.

According to a report by the Wall Street Journal, staff of the online retailing giant’s China operation received between $80 and more than $2,000 to part internal user and sales data to brokers, who would then re-sell them to merchants who do business on Amazon platform. According to the WSJ report, it was not only Amazon’s internal sales metrics and users’ email addresses that were sold, also on offer was additional services. The staff would help the buyers to delete negative reviews and to re-open banned Amazon accounts.

It is said the malpractice was particularly rampant in Amazon’s office in Shenzhen, the city bordering Hong Kong. It is not the first time China’s online retailers suffered from data security comprise. Back in 2016 over 20 million of Alibaba’s users had their data hacked. Nor is this the first time that Amazon has found itself in the centre of data leaking controversies, but earlier cases were related to its cloud service AWS. So it is astonishing that in the present case, data was not breached by hacking but through blatant criminal transactions. It is not clear how many users have had their data sold.

Amazon released a statement saying “We have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behaviour, we will take swift action against them, including terminating their selling accounts, deleting reviews, withholding funds, and taking legal action.”

Amazon set up its business in China in 2004 after acquiring a competing online bookshop Joyo with $75 million. It was rebranded Amazon China in 2011.