Among other places, in the United States. The CFAA [0] prohibits "access[ing] a computer without authorization or exceed[ing] authorized access". It's interpreted extremely broadly by the courts.

[0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act