It's an alleged legal breach of Data Protection principles. That language is used historically by the ICO in the UK to describe exactly this type of situation.
Facebook's responsibilities and Cambridge Analytica's responsibilities towards data protection have been breached.
There's no other useful word for that. It might not be a hack and it might not be a security vulnerability, but it is surely a breach.
> A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes.
Facebook's responsibilities and Cambridge Analytica's responsibilities towards data protection have been breached.
There's no other useful word for that. It might not be a hack and it might not be a security vulnerability, but it is surely a breach.