Facebook has revealed that in 2015 a University of Cambridge researcher, Aleksandr Kogan, passed user data to third parties, including SCL Group/Cambridge Analytica and Christopher Wylie of Eunoia Technologies, in violation of the company's platform policies. Cambridge Analytica, Kogan and Eunoia certified to Facebook that they destroyed the data, but they did not. Three years later, the public is only now being made aware of this breach.
Cambridge Analyica was a contractor to President Donald Trump's 2016 election campaign. Indeed, its CEO, Alexander Nix, made efforts to contact Wikileaks founder Julian Assange to help distribute hacked DNC emails to help Donald Trump get elected. Because of the sensitive nature of these parties, and because it should be liable to its users for such breaches, Facebook has a duty to inform all users affected by this breach.
Notification should include all users whose data was directly or indirectly shared with these parties, and how that information was used to target them with political advertising by Cambridge Analytica, the Cruz or Trump campaigns, or any other entity that CA did business with.