It wasn't a breach as we know it. Basically FB gave the data away. Apps have access to the data but they're not allowed to give/sell it to third parties. In th

It wasn't a breach as we know it. Basically FB gave the data away. Apps have access to the data but they're not allowed to give/sell it to third parties. In this case the rules were ignored. Probably many other companies with API access have also ignored the rules. In this case FB didn't make much of an effort at all to prevent it from happening so it's reasonable to assume the practice is rampant. There's likely many copies of large parts of FB data out there (left on laptops on trains or on unprotected FTP/HTTP servers, etc.). It's a 'breach' from the users' perspective.