> It is important to understand that malicious actors obtained this data not through hacking our systems but by scraping it from our platform prior to September 2019.
.. a couple paragraphs later ::
> We believe the data in question was scraped from people’s Facebook profiles by malicious actors using our contact importer prior to September 2019.
Gee, that sounds a lot like someone abused your contact importer tool to do something you didn't intend for it to do. Which is also the definition of other "hacks", like SQL injection
> It is important to understand that malicious actors obtained this data not through hacking our systems but by scraping it from our platform prior to September 2019.
.. a couple paragraphs later ::
> We believe the data in question was scraped from people’s Facebook profiles by malicious actors using our contact importer prior to September 2019.
Gee, that sounds a lot like someone abused your contact importer tool to do something you didn't intend for it to do. Which is also the definition of other "hacks", like SQL injection