Y can't be sued for anything if they do not know that it was originally confidential, but they *CAN* be sued for using said information after they have learned that it was misappropriated, which they could learn very shortly afterwards. Sort of like how you can't be prosecuted for buying stolen merchandise from someone else if you didn't realize that it was stolen, but you aren't allowed to keep what you bought once its origin has come to light. You are, however, allowed to sue the person you bought it from. In the case of a broken confidentiality agreement or NDA, it's my understanding that if the information has only been transferred to one party, then the court grants an injunction against the party from utilizing that information, and that party can claim legitimate damages from the party that they acquired it from. The situation you describe is only applicable in a circumstance where the confidential information was revealed to the general public, and the "genie is out of the bottle", as it were.
Of course, all of this is applicable to the story were are discussing only if the guy who sold the Rift to Facebook was not actually entitled to do so.