The breach was announced by Facebook itself on 28 September 2018. It worked something like this…

Facebook has a View As feature that lets you preview your profile as other people would see it. This is supposed to be a security feature that helps you check whether you’re oversharing information you meant to keep private.

Facebook opens up about data breach details