https://www.bbc.co.uk/news/technology-46065796

Facebook said its security had not been compromised.

And the data had probably been obtained through malicious browser extensions.