A 12G data package belonging to JD.com, a leading online retail platform in China, has reportedly been leaked. The package contains tens of millions of pieces of personal data, including user names, passwords, email addresses and IDs, according to a report by Jiemian News.

In an announcement on Dec. 11, JD.com said the leak originated from a Struts 2 vulnerability in 2013, and the company has fixed the problem. The announcement further suggested that users activate mobile certification and payment codes, and update and strengthen their login passwords.

This is the second time that JD.com has been involved in a user information leak. In 2015, three employees of JD.com sold a total of 9,313 pieces of information, including names, telephone numbers and addresses, for between 0.3 RMB and 1.5 RMB per piece.