this is about privacy not security though. and all of these sensationalized articles fail to mention that users consented to share that data with the apps when they first used it through a dialog that's pretty much unambiguous. Even their table says so: "permissions", plus i m pretty sure at that time facebook was already sharing an app-scoped, not the global user id. Regardless , it was sloppy privacy practices, which were fine at the time and nobody cared because Trump had not happened. It's not a security breach, though.