Photos of up to 6.8 million Facebook users, including ones they never posted, could be accessed.