“I agreed to send them the data and the website of course, for that was my purpose,” he wrote. “I tried to ask what they would do next but they said it would be an internal legal investigation. I asked if it was possible to tell what the problem was, after they finished the investigation, so that the users could protect themselves, but they emphasized that it would be an internal investigation and they would not share any information with third parties.”

In a later blog post, Shopov called on Facebook to permanently delete user data when accounts are closed on the social network.

“I want Facebook to start removing entire user data after pressing ‘Delete my account,’” he wrote. “Is this so much to ask. This is fair, isn’t it?”

A Facebook spokesman issued the following response:

Facebook is vigilant about protecting our users from those who would try to expose any form of user information. In this case, it appears someone has attempted to scrape information from our site and combine the information with data publicly available elsewhere on the web. We have dedicated security engineers and teams that look into, and take aggressive action on reports just like these. In addition to the engineering teams that build tools to block scraping we also have a dedicated enforcement team that seeks to identify those responsible for breaking our Terms and works with our Legal team to ensure appropriate consequences follow. We continue to investigate this specific individual.

In a follow-up e-mail, the spokesman pointed to this link that explains how people can go about having all their Facebook account data permanently deleted.

Article updated to add last paragraph.