Cambridge Analytica data harvesting
Data compromised
Details not publicly disclosed
Technical writeup
Third-party app 'thisisyourdigitallife' collected data from users who took a personality quiz, and due to Facebook's Graph API at the time, also collected data from those users' friends without explicit consent. The data was then sold to Cambridge Analytica for political advertising. The vulnerability was in the platform's app permissions and friend data access policies.
Root cause
Overly permissive Graph API allowing apps to access friends' data; inadequate app review and data access controls.