Facebook said intimate data, including search results, recent locations and hometowns, were stolen from 14 million users by attackers in a major hack disclosed two weeks ago.
The company said the cyber-attack, one of the worst to hit Facebook, affected 30 million people rather than about 50 million the company first reported on 28 September.
While the total number of accessed accounts was smaller than initially thought, the personal data taken from about half of the affected accounts was extensive.
For about 14 million people the hackers accessed information such as the last 10 places that person checked into, their current city and their 15 most-recent searches.
For 15 million, the cyberthieves only accessed name and contact information. The attackers didn't take any information from about 1 million people whose accounts were vulnerable.
A smaller slice of people were more heavily affected. About 400,000 people served as the hackers' entry point to the 30 million others on Facebook.
For those 400,000, the attackers could see what the users see as they look at their own profiles. That included posts on their Facebook timelines, and names of recent Facebook Messenger conversations.
So far, Facebook said it hasn't seen the information appear anywhere else online, but the company continues to investigate the incident with the FBI.
This sort of personal detail can help identity thieves accomplish hacks for years into the future.
Facebook declined to say whether stealing identities, or anything else, was the motive for the attack.
"We are cooperating with the FBI on this matter. The FBI have asked us not to discuss who may be behind this attack," Guy Rosen, a vice president of product management at Facebook, said on a call with reporters.
