Legally CFAA criminalizes unauthorised access of systems even if they were available and unauthenticated. If you are not supposed to have access and you access

Legally CFAA criminalizes unauthorised access of systems even if they were available and unauthenticated. If you are not supposed to have access and you accessed it is a crime. This is why whitehat work is also dangerous legally unless you have been invited in. Here obviously the attackers accessed a private environment and stole the keys so yes it is a crime