This is a crime under Canadian law - multiple crimes actually. These crimes come with heavy sentences. Citizens via lawyers can launch criminal action in Canada. You don't have to wait on the police. If you are attacked by the media you can trigger a criminal investigation, and launch civil action as well. You have criminal mischief in the use of the stolen data, (up to life in prison if life is lost,) as well as identity theft crimes. I'm sure there are several others.