You could make a good case for 'exceeds authorized access' under the Computer Fraud and Abuse Act for this. You might even get some action if you filed a complaint, because it's from China.