[empyrrhicist]

If you're in the US, that's 100% a crime. If they were responding to an unauthenticated API or web request that's one thing, but using a leaked password on a database is not legal at all.

[rtev]

Yeah, 3+ years in prison for that. Corporate espionage hacking is real.