Perhaps the article doesn't have enough detail in it. But it sounds like ISPs were just sniffing HTTP packets for usernames and passwords.

It doesn't sound like a directed attack on facebook, though perhaps it was a session replay attack.

The real question for me, is why didn't facebook already require SSL login.