> might very well have been legal had he just avoided payment information and stuck to stolen databases containing emails, phone numbers, passwords

I suspect that you are wrong about this.

https://en.wikipedia.org/wiki/Accessory_(legal_term)

"Count 1: Conspiracy to Commit Access Device Fraud (18 U.S.C. §§ 1029(b)(2)and 3559(g)(1))

Count 2: Access Device Fraud — Using or Trafficking in an Unauthorized Access Device (18 U.S.C. §§ 1029(a)(2)and 2)

Count 3: Access Device Fraud — Possession of Fifteen or More Unauthorized Access Devices (18 U.S.C. §§ 1029(a)(3)and 2)

Counts 4-5: Access Device Fraud — Unauthorized Solicitation (18 U.S.C. §§ 1029(a)(6)and 2)

Count 6: Aggravated Identity Theft (18 U.S.C. §§ 1028A(a)(l)and 2)"

If this sticks he will be gone for a long, long time, and, crucially, he handed over the the evidence himself so no amount of 'it wasn't me' is going to help here.

Accessory after the fact:

> Whoever, knowing that an offense against the United States has been committed, receives, relieves, comforts or assists the offender in order to hinder or prevent his apprehension, trial or punishment, is an accessory after the fact.

It’s not obvious at all that selling e.g. the leaked Linkedin database would be illegal in any way. You wouldn’t retroactively become an accessory to the original crime.

Of course, that stopped mattering the moment he started trafficking in stolen payment card information…

A reminder not to take legal advice from HN.

Also important to keep in mind he ( most likely ) wasn’t aware of US law. Not sure how Portugal classifies businesses such as these, but we know how e.g. Russia differs in this regard.

Yes, true, but that's exactly why if you aren't aware of something or unsure of something you play it safe. The number of people that got busted like this is large enough that I'm 100% sure that he was aware that this wasn't a legal operation, in fact he went to some length to hide his identity, which shows at least minimal awareness of this.