Cyberattackers stole data from 29 million Facebook accounts using an automated program that moved from one friend to the next, Facebook announced on Friday, as the social media company said its largest-ever data theft hit fewer than the 50 million profiles it initially reported.

The company said it would message affected users over the coming days to tell them what type of information had been accessed in the attack.

The breach has left users more vulnerable to targeted phishing attacks and could deepen unease about posting to a service whose privacy, moderation and security practices have been called into question by repeated scandals over the years, cybersecurity experts and financial analysts said.