It's not hypocritical. There's something very different about a government doing this, let alone a foreign government.

Private domestic entities are subject to lawsuits, if the injured party believes their rights have been violated. The recourse is clear.

If it's the US government getting directly involved (e.g. IRS leak), that's a huge scandal. That's why Watergate led to the resignation of a president.

The only way we can hold foreign governments accountable is via our own government. So sanctions would seem to be completely appropriate to me.