I wouldn't call any of your examples hacking, at least not in the "hacking other people's systems" sense. It's accessing information the other party actively sent to users. The fault lies with the one distributing and potentially exposing sensitive information through negligence.