If they were to actually exploit their possession of the information (eg. get credit in the person's name by piecing together confetti with name, DOB, and SSN), it would be a crime.

The tricky thing is that with hacking, the line between piecing together the vulnerability and exploiting it doesn't involve as much clearcut intent and harm.