That would also attract the attention of the Feds. The thing here is "unauthorized access of a computer network". The definition of what is authorized is whatever AT&T says it is. As was mentioned earlier, some important people had their info exposed, and someone has to pay for it. It certainly won't be AT&T, that's for certain.
There's a couple other odd cases like this that were prosecuted that were less clear-cut. One was the organization that was using bots to purchase Tickets at Ticketmaster - they were going through the public interface, just automating the purchase process. And the other case of the woman making a fake MySpace account leading to her neighbor's daughters suicide. There is was determined merely using a pseudonym was in violation of the TOS, and therefore an unauthorized access.
In either of these two cases, it appears that the prosecution looked for something, anything to throw at the defendants because there was no specific law against being an ******.