How can we be sure that they don't sell information they acquire? And even if they just do it for the heck of it, hacking is still a criminal act.
What they are doing is indeed a criminal act, however hacking in general is not necessarily illegal (hacking is a very broad subject).
And what Yacoby is getting at is: better some chaos group than a known criminal group that will undoubtedly use the information for sinister things.
Really, though, this needs to all be a wakeup call to the industry: You are NEVER too small to be a target.