Facebook discovered a "security issue" affecting 50 million accounts. Hackers were able to steal access tokens. But Facebook have said that,
So far, our initial investigation has not shown that these tokens were used to access any private messages or posts or to post anything to these accounts.
How is this possible? If they have the access token, why can't they access private messages and posts?