Have you tried reporting this to Meta’s security team and copying your state’s attorney general? Sounds like the CFAA would apply. You may not win, but making noise may help, and if it’s an insider they might be fired if Meta knows the legal apparatus is notified.
https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act