The "Computer Fraud and Abuse Act" applies to the US.
What if the hacker lives somewhere else? Then that law does not apply to him, and the action was not illegal.
Even countries that don't have shared extradition treaties don't always ignore criminals within their borders, even if the criminal activity is occurring outside.