They were pretty clever, because they used proxies in my region so facebook wouldnt send me automatic warnings.
I can only encourage everyone to check their running Ads & campaigns and check the audit history log at business.facebook.com asap!
Facebook support sucks (also for business users) so dont expect to get your money back.