The account recovery feature allowed for scraping of any public profile data. Also this: CA actually may have gotten 87m users’ data.
Hooray! Facebook ditches searching for people by phone number or email
http://sophosnews.files.wordpress.com/2018/04/shutterstock_159315359.jpg?w=170&h=90&crop=1