Reuters is reporting that a Russian technology company known as Pushwoosh falsely presented itself as American-based, and its software found its way into thousands of apps on Apple’s and Google’s online stores.

The CDC told Reuters it has removed Pushwoosh software from seven public-facing apps after discovering the deception while the U.S. Army said it had removed an app containing Pushwoosh code back in March. That app was used by soldiers at a main U.S. combat training base.

Reuters reviewed company documents filed publicly in Russia which showed that Pushwoosh is headquartered in a Siberian town and that it is registered with the Russian government and pays taxes in Russia. However, on social media and in U.S. regulatory filings, it presents itself as U.S.-based, at various times in California, Maryland and Washington DC. 

On its website, Pushwoosh says it does not collect sensitive information, and its owner says it has “no connection to the Russian government of any kind.” Further, Reuters found no evidence that the company had mishandled user data.

However, the Russian government has in the past compelled local companies to hand over users’ personal information to the Russian spy organization FSB.