A friend sent me this message:
Safety Announcement
While on FB, look at your URL address (the very top box on your screen). If you see "http:" instead of "https:" then you DO NOT have a secure session and can be HACKED. Go to Account - Account Settings - Account Security - click Change. Check box (secure browsing), click Save. FB has automatically set it on the non-secure setting! Do your friends a huge favour. Copy and re-post.
I checked my FaceBook, and the setting was http instead of https.
I invite you to check your accounts ASAP.