Sensitive Facebook information for up to 120 million users was exposed online for years, researcher says.