This is not the first time, obviously. I remember vividly how they sometime 2008 or 2009 made all pictures in the Profile Pictures folder public - that's when I realized they can't be trusted at all with protecting information.