Was affected by this. Hacker used the token to run rogue Ads on my business manager account.

They were pretty clever, because they used proxies in my region so facebook wouldnt send me automatic warnings.

I can only encourage everyone to check their running Ads & campaigns and check the audit history log at business.facebook.com asap!

Facebook support sucks (also for business users) so dont expect to get your money back.