FB's case is different. I think the term for FB's case is private data abuse rather than leak. Cambridge Analytica took the data through API just like every other app doing at the time, but violated the terms of use. FB is guilty because it designed the wrong way (no excuse) to share the information (still under consent). For example, banks share your personal info around all the time (say promo mails). For Yahoo, that's ... poor technology & management.