1 . If the hackers have this token, what can they be able to do with it?
That depends on the individual "social network", but such tokens are mostly configured to expire/invalidate after a certain period of time. Also, the networks you mentioned all have multiple security implementations running to limit such attack vectors by — among other things — linking the token to the IP. Ask yourself how unlikely it is that an attacker will be able to fetch multiple characteristics simultaneously… I can't say it'll not happen, as Murphy's law would most certainly prove me wrong. ;)
2 . Assuming that the hackers have gotten a hold of my database, what can I as a developer do, to minimise the effect of the leak? What are the good practices for such login?
Follow the procedures you would follow in relation to every information security incident — apply the 6 Phases of Incident Management:
To dive deeper into "incident management", you might want to start out by checking the following infos: