TikTok’s Chinese parent company ByteDance admits it spied on two BuzzFeed journalists, though the journalists say at least four people were spied on and tracked after breaking stories about the seemingly innocuous app’s surveillance of U.S. users.

It’s a bad week for the video-sharing app TikTok, as just a few hours ago on Tuesday morning, the U.S. House of Representatives banned TikTok from all House-issued mobile devices. More than a dozen states, and the U.S. military have implemented the same rule with government-issued devices, over lingering national security concerns that the app’s Chinese parent company ByteDance is doing surveillance work on behalf of the Chinese government.

And there is yet more fodder for an anti-TikTok backlash. Prior to today’s House ruling, TikTok was already reeling over a pre-Christmas Eve revelation that the company spied on journalists who’d written critically about the company’s surveillance tactics, according to the New York Times. The Times reports that ByteDance’s “internal investigation found that employees had inappropriately obtained the data of U.S. TikTok users, including that of two reporters.,” but the reporters say at least four of them were spied upon, and this could be the tip of a much larger iceberg.

This affair goes back to this past June, when then-Buzzfeed reporter Emily Baker-White broke a story that Chinese employees were accessing private data of U.S. users. Baker-White moved on to Forbes, and broke an October story for that publication that ByteDance employees were tracking the private locations of certain U.S. users. And now we learn that one of the people they were tracking and surveilling was none other than reporter Emily Baker-White.

ByteDance claims that only four employees were involved in the spying, and they’ve all been fired. “I was deeply disappointed when I was notified of the situation,” ByteDance CEO Rubo Liang wrote in an all-company email when the story broke last week. “The public trust that we have spent huge efforts building is going to be significantly undermined by the misconduct of a few individuals.” (The Verge has the full “I’m shocked to find there is gambling going on in here” emails from numerous top ByteDance executives.)

And again, this may be the tip of an iceberg. ByteDance admits employees spied upon Baker-White and Financial Times journalist Cristina Criddle. But the New York Times notes the company also admitted to spying on “on a small number of other U.S. users,” and Forbes itself reports that ByteDance “tracked Emily Baker-White, Katharine Schwab and Richard Nieva, three Forbes journalists that formerly worked at BuzzFeed News.”

Even with today's House of Representatives ban, lawmakers are flagging TikTok far more aggressively, so the timing of this scandal is bad for the app. The Senate passed a bill last week to ban TikTok from all federal government devices, and Florida Senator Marco Rubio is pushing a bill to ban TikTok outright in the U.S.

“No one should be surprised or fooled by ByteDance’s public apology,” Rubio said in a statement to the Times after last week’s scandal broke. “The company is desperate to tamp down growing bipartisan concerns about how it enables the Chinese Communist Party to use — and potentially weaponize — the data of American citizens. Every day it becomes more clear that we need to ban TikTok.”

Related: Top FCC Commissioner Demands Apple and Google Yank TikTok From Their App Stores [SFist]

Image: franckinjapan via Unsplash