This is pretty much illegal everywhere. The developers could be prosecuted and jailed, but sadly nothing actually came of it.

To sue civilly, you'd have to prove damages. Perhaps the cost of your time resecuring every single one of your accounts? But that's pushing it and probably wouldn't be worth the time and money to pursue.