If you live in the EU or the UK, this might also be a personal data breach that Facebook must report to the relevant national data protection authority, because

If you live in the EU or the UK, this might also be a personal data breach that Facebook must report to the relevant national data protection authority, because it gave your private data to an unauthorised third party (if the release of that data could risk your rights or freedoms). Failure to notify so can result in fines of up to 2% of global turnover. You may need to contact your national data protection authority directly if Facebook has not notified them.