I don't think they can make money off plain text passwords? They can only lose money from that, if it's discovered and they are fined and lose some users.

They can make money from contact lists, but IIUC the article said they didn't use the contact lists. Also, given that it only affected a couple million users (like 0.1% of their user base), the damage to their reputation would far outweigh any benefits of actually using those contact lists.

On the last item, the collection of email passwords, the only benefit would be if they actually use those passwords to get information, so the above point covers it.

Let me know if I'm missing something.

how about extracting a user's contacts with their plaintext passwords that would usually be hashed into a database (at least in my professional experience) and thus unusable by facebook?

You can do many evil things with passwords. But, according to the articles, that's not what happened. They did download contact lists, even though they never used the plaintext passwords they stored in the logs. The users involved in the two incidents were different.

Storing plain text passwords doesn't make them money, but it negatively affects users, should those passwords be compromised. Though FB didn't prosper from the mistake, users potentially feel a cost, so the outcome is the same. Criminal negligence might not benefit the bad actor, but it's still a crime either way.

Yes that's a good point.

It's a bit like Exxon Valdez: they don't profit from spilling oil in the ocean, but they should still be penalized for cutting corners on safety.

or using the plaintext passwords to extract a user's contacts when hashing it into a database would prevent facebook from impersonating that user and logging in to access their non-facebook social graph?