There's some quibbling at the moment about whether this constitutes a "data breach" of Facebook at the moment. So for clarity...
Different people are using different definitions of "breach". Techies use "breach" to mean they attempted to protect data with technology and someone broke in through the technical protections.
Facebook didn't even try to protect the data, so this isn't a "breach" in the techies' language.
Laypeople are going "We trusted you with our data and now without our knowledge some other bugger has it and is using it against us," and are understandably describing this as a "breach."
Fuller explanation here:
Why We're Not Calling the Cambridge Analytica Story a 'Data Breach'
Facebook insists that Cambridge Analytica didn't get information on 50 million Americans because of a 'data breach.' It's right. What really happened is much worse.
motherboard.vice.com/en_us/article/3kjzvk/facebook-cambridge-analytica-not-a-data-breach
Facebook’s vice president and deputy general counsel Paul Grewal wrote that “the claim that this is a data breach is completely false,” because the researcher who made the app obtained the data from “users who chose to sign up to his app, and everyone involved gave their consent.”
Saying that “everyone involved” consented seems misleading, given that only around 270,000 out of the 50 million people who got their data harvested reportedly signed up for the app. The others probably had no idea this app even existed. And since Facebook changes its privacy settings so frequently, we also don't know if the people who agreed to use the app fully understood what kind of data they were giving up. And no one at the time knew the data would later be handed out to a shadowy data analytics firm hired by the Trump campaign.
[...]
As Zeynep Tufekci, the author of Twitter And Tear Gas, put it, Facebook’s vehement defense that this was not a data breach is itself actually a damning statement of what’s wrong with Facebook, and Silicon Valley’s ad industry in general.
“If your business is building a massive surveillance machinery, the data will eventually be used & misused,” Tufekci, a University of North Carolina professor who studies the social impact of technology, wrote on Twitter. “There is no informed consent because it's not possible to reasonably inform or consent.”
Facebook’s security team, Tufekci concluded, can’t mitigate the company’s business model, which is predicated on collecting as much of our data, and our friend’s data, as possible.