Third time lucky — unless you’re Facebook.

The social networking giant was hit by a trio of investigations over its privacy practices Thursday following a particularly tumultuous month of security lapses and privacy violations — the latest in a string of embarrassing and damaging breaches at the company, much of its own doing.

First came a probe by the Irish data protection authority looking into the breach of “hundreds of millions” of Facebook and Instagram user passwords were stored in plaintext on its servers. The company will be investigated under the European GDPR data protection law, which could lead to fines of up to four percent of its global annual revenue for the infringing year — already some several billions of dollars.

Then, Canadian authorities confirmed that the beleaguered social networking giant broke its strict privacy laws, reports TechCrunch’s Natasha Lomas. The Office of the Privacy Commissioner of Canada said it plans to take Facebook ti federal court to force the company to correct its “serious contraventions” of Canadian privacy law. The findings came in the aftermath of the Cambridge Analytica scandal, which vacuumed up more than 600,000 profiles of Canadian citizens.

Lastly, and slightly closer to home, Facebook was hit by its third investigation — this time by New York attorney general Letitia James. The state chief law enforcer is looking into the recent “unauthorized collection” of 1.5 million user email addresses, which Facebook used for profile verification, but inadvertently also scraped their contact lists.

“It is time Facebook is held accountable for how it handles consumers’ personal information,” said James in a statement. “Facebook has repeatedly demonstrated a lack of respect for consumers’ information while at the same time profiting from mining that data.”

Facebook spokesperson Jay Nancarrow said the company is “in touch with the New York State attorney general’s office and are responding to their questions on this matter.”