Clearly, they're not in trouble for sending emails. The emails were simply the evidence of the crime they got caught carrying out.
I get more upset by the companies getting hacked once their negligent practices come to light.
And despite all this the subject has become a routine talking point for censorship proponents, nicely demonstrating a warped framework that prioritizes centralized whims over individual rights.
If it's just the number, i.e. "A cc with number X exists", I'm ok with that.
If they use the number to make purchases, that's a criminal offence separate from knowledge of the number per se.
Think of it like this: seeing a person get murdered isn't a crime. Facilitating murder in any way is.