1. A computer-implemented method, comprising: processing, by a threat detection tool executing at a processor in a social networking system, a plurality of accesses of private data associated with end-users of the social networking system to identify associated query structures, wherein the plurality of accesses of the private data are data accesses of the private data associated with the end-users and initiated by a source user account associated with a source user who is authorized to access the private data, wherein the source user is a user who has obtained a token, from the social networking system, that authorizes the source user to access the private data associated with the end-users, and wherein the plurality of accesses of the private data are stored in one or more private access logs in computer memory on the social networking system, wherein the plurality of accesses of the private data are initiated by the source user account occur over a specified duration of time; applying, by the threat detection tool, one or more filters to the plurality of accesses of the private data of the source user to identify a subset of the plurality of accesses of the private data, wherein the subset of accesses of the private data have query structures that indicate specific targets; processing, by the threat detection tool, the specific targets to determine whether an access pattern exists, wherein the access pattern indicates a measure of commonality among two or more of the specific targets; and triggering, by the threat detection tool, an alarm based on a determination that the access pattern exists.