It probably would have been best to just notify Winzip.
Telling the FBI you broke into a server to see if you could, and that you found that someone else had also broken in before you is just plain stupid.
Telling the FBI you broke into a server to see if you could, and that you found that someone else had also broken in before you is just plain stupid.
Not that it says anything about whether he'll be in legal trouble. Laws are crazy.
The CFAA in the US might apply, section a.2.c bit is pretty broad: information from any protected computer). The wikipedia article is full of interesting bits and bobs: http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
Though whether or not a DA would be bothered with investigating and building a case is a different story (probably not, unless there were lots of complaints and/or "serious" complaints).
I strongly doubt anyone, even at the FBI, is tasked with finding hackers independent of any complaints.
Weev got 3.5 years and also did nothing malicious with the data he found: http://www.wired.com/2013/03/att-hacker-gets-3-years/
He did not break there to make himself rich or to cause any trouble for the server owner; quite the contrary.