Sue them under CFAA for accessing a site they weren’t granted permission to access, brick their device and take their money