Simply changing passwords is likely not illegal. If information contained is used to impersonate and individual, this may be illegal.