It’s a little more complicated than that... He didn’t just visit URLs, but downloaded that data, saved it, and posted it up somewhere else. Regardless of the “hacking” charge, posting people’s data is taking it too far. If he had just used it as a POC, that’d be different.