The company says after more searching, they learned it affected only 30 million accounts, down from their first estimate of 50 million.
They say for 15 million people, attackers got the account name, and contact details like phone number and email address.
For another 14 million people, the attackers got their hands on those two pieces of information and other details like religion, birthdate, and device types used to access the social media site.
For one million people, Facebook says attackers gained no information.
They add the attack did not include Messenger, Instagram, payments, or third-party apps.
The company says all those affected will get messages explaining what information the attackers may have taken, and what steps users should take to protect themselves.