Assuming US jurisdiction this would pretty clearly be at least one, probably many CFAA violations which are criminal.