I am being specific about cyber crime in the united states, which (if AI is to be believed) requires intent.

And for negligence, there's a bit of an issue where the HF hack was probably more scary than damaging. HF is asking for compute as repayment instead, which would be fun because it completes the OpenAI -> HuggingFace -> NVIDA -> OpenAI cycle.