Question to anyone in the know...

Are those stolen password sites (that post usernames and passwords to paysites) actually breaking any laws?

On occasion I find a user/pass for our site on these lists and wonder what I can do about it beyond just deactivating the account. I thought for a second about sending a DMCA notice; but they aren't posting any physical copyrighted property, so I don't think that would work...

But since they are posting 'stolen' user accounts, which would infringe on monetary gain (for us); i would guess they are breaking a law of sorts...right?

Do you guys do anything beyond deactivating the account if you find a stolen user/pass?