Facebook said a year-long data breach inadvertently exposed 6 million users' phone numbers and email addresses.