Can someone please explain to me what the breach is here? As far as I can tell this was just an app using the API as intended. Except they did some additional

Can someone please explain to me what the breach is here? As far as I can tell this was just an app using the API as intended. Except they did some additional modeling on their backend to organize/profile users. They abused the TOS for sure, but was there an actual security breach?