The data appears to have been stolen with malicious browser extensions, and not by exploiting an issue with Facebook’s platform.