> The point of focus should be verelox and the criminal negligence on their part. Verelox is the criminal
Nope. The affected customers probably have grounds for a civil suit, but no sane prosecutor would think bringing criminal proceedings against Verelox to make sense at all.
The ex-employee who perpetrated this is at fault as well and must bear responsibility for his destructive actions. Having the ability to do something (even due to a lapse in security) does not make that action moral or legal.
We should not equivocate on cfaa. It is good for nothing. Full and unconditional repeal should be our only demand.