Yes, the police are definitely the wrong group, as their jurisdiction is just local or state, and almost none would have much a clue of how to proceed. However

Yes, the police are definitely the wrong group, as their jurisdiction is just local or state, and almost none would have much a clue of how to proceed. However, the FBI might be very interested. While these situations may be just be a couple of friends scamming, it could also be the tip of the iceberg of an organized crime operation or an espionage operation. Many countries are actively working to get inside American corporations to steal both their technology and anything related to any govt work and secrets. There is not much better way to gain access to the network than to be able to login as an employee. Even if that one case alone isn't that interesting to them, having the data may very well help crack a much more important NatSec case. Gather the info and report it.