While the crime is done using computers, it seems like it could be fraud, if they are trying to use the access to spend money or steal information to do somethi

While the crime is done using computers, it seems like it could be fraud, if they are trying to use the access to spend money or steal information to do something with? Given the nature of the attack being aimed directly for one customer, if I were you, I would possibly alert that customer that something funny is up. That way they might be able to prevent the same thing happening at other companies they use that might not be as careful. As far as dealing with the police, if they didn't manage to get anything, I wouldn't bother. Keep the info around just in case.