Reply to post:

Proving who did it is usually the problem.

They should be charged with handling stolen information and a new crime of "willfully using illegally obtained data".

It's easier to prove what someone has, than what someone did.