Comment by DCF

How would that not be a breach? Their system allowed a malicious entity acting in bad faith to gain large amounts of data under false pretenses. If they got the data by pretending to be an employee and social engineering their way into the data that way facebook would 100% call that a breach. Is this that different?