I&#x27;m not actually clear what crime was committed. Divulging trade secrets or proprietary information is not a violation of the CFAA is it? Even so, how is divulging a (presumably expired) username and password any different than a security researcher releasing a PoC exploit? We don&#x27;t (yet) prosecute researchers, even though they reasonably should know that their code could be used to exploit actual systems.