A few months ago, the company disclosed that apps were siphoning data from up to 9.5 million of its users. It only found out thanks to a bug bounty submission.
https://www.wired.com/story/facebook-bug-bounty-app-data-stealing
https://www.wired.com/story/facebook-bug-bounty-app-data-stealing