The breach arose from the exploitation by unauthorised third parties of user tokens on the Facebook platform.