For example, we think of trading stolen credit card numbers as wrong, but only because we have bought the narrative of identity theft, which was constructed to pass the burden onto the populace instead of the people handing out goods/services/money to verify identity. If you disregard the concept of identity theft, and think that instead it should be considered just theft, not from the one who possesses the identity used, but from the entity that handed out goods/services/money, then we need to reevaluate the ethics/morality of trading credit card numbers.
Consumer facing though, they'd like to define it as "identity theft" because "identity" is a bedrock abstraction their system is built on. They would like an "identity" to be something prescriptive and airtight (rather than imperfectly descriptive) because it would make their job/business that much easier.
Clearly, they're not in trouble for sending emails. The emails were simply the evidence of the crime they got caught carrying out.
I get more upset by the companies getting hacked once their negligent practices come to light.
And despite all this the subject has become a routine talking point for censorship proponents, nicely demonstrating a warped framework that prioritizes centralized whims over individual rights.
If it's just the number, i.e. "A cc with number X exists", I'm ok with that.
If they use the number to make purchases, that's a criminal offence separate from knowledge of the number per se.
Think of it like this: seeing a person get murdered isn't a crime. Facilitating murder in any way is.