3+ years ago, their Graph API provided much more information than it does today. App developers (CA, in this case) used that open API to get information about the app user's friends, and then stored that data on their own servers (which is and always was against Facebook's Terms of Service).