Ars Technica lost a lot of respect with me yesterday when they stated in the analysis of Mega's security that symmetric encryption is inherently less safe than asymmetric.
Also the quoted article does not appear to show considerable insight on internet security.
Sheer directory traversal should never be considered a criminal act.
Of course if they had followed through with the stock manipulation, this would warrant criminal punishment.
Although of course stock manipulation is only punishable if you're not a bank or hedgefund which is sad.