“A Facebook spokesperson told Insider that the data had been scraped because of a vulnerability that the company patched in 2019.”
Facebook’s defense is that the hole is old. The phone numbers are not. Nobody changes their number because Facebook lost it. 32 million Americans are now one search away from a SIM swap, and Facebook calls it scraping so it never has to call it a breach.