WASHINGTON (AP) — In a first-of-a-kind case, the Federal Trade Commission is targeting a data broker for allegedly selling sensitive consumer information — including bank account numbers — to marketers that authorities said the broker knew had no legitimate need for it.

In its lawsuit, the commission charges that Arizona-based LeapLab bought the payday loan applications of people strapped for money, then turned around and sold that data to third-parties who most often weren’t lenders at all. The loan applications contained sensitive information such as a consumer’s Social Security number, bank account number and routing number to the bank.

The FTC says at least one of the marketers buying data from LeapLab used the information to withdraw more than $4 million from consumers’ bank accounts without authorization.