But the company leaking consumer information to the public without any proper security at all is not punished.
Everyone here keeps purposefully ignoring intent, but in the context of the law this is impossible. So no matter how much you hate it, this isn't something that can be a binary yes/no illegal/legal question based on some computer response to your query.
The law involves intent. They proved he intended to act in bad faith while gathering that data and he was rightfully found guilty.
Why you are having a hard time understanding that "we put him in jail because we don't like what he did" is wrong I have no idea. You must be a troll disagreeing on purpose.