Can you sue them for this, though? Your contract would need to say "if I personally turn my data over to a third party, that third party will not misuse it". And in the unlikely event that it did say that, misuse of your data by the third party still wouldn't violate the contract, because... the third party is not party to the contract.

Even if you don't buy that argument, at the very least the people who were FB friends of people who sent shared their lists with Kogan should still be able to sue FB, as they had absolutely no relation with Kogan or his app and still some of their data ended up sold.

FB doesn't just hand users' data over without user confirmation... Users see UI permission dialogs and have to explicitly agree to it first (similar to an iPhone app asking for permission to use your microphone or location -- how is Apple responsible if said app gets hacked and leaks your microphone recordings?).