The scary part is the cat is already out of the bag if you authorised any app. They could have a wealth of your data that is being sold.
'If you authorized any app'? I'm sure there are workarounds for that. If you touch them or pages where their invisible Facebook gif is present, they've probably got all your data that's gettable.