Why do we not know who he is? Is it not a crime in the US to leak/steal data and leak it to third parties?
You've released this scumbag back into the pool to continue his shenanigans elsewhere.
You've covered your ass, and now he's someone else's problem, right?