IIRC there was a recent story here in Germany where a court decided that the blame is entirely on the website owner, and incrementing an integer didn't constitute as hacking, as no security measures were circumvented (as a lack of authorization checks meant no security measures were in place).

So I'm hopeful that the courts are slowly starting to wisen up in that respect.