If they stole data from 100K bank accounts using SSN generator and then sent those to the press - yes, probably. Since they instead accessed their own account to which they were authorized to connect anyway - no, not right.