Contrary to the list charter, quite probably.
Illegal? Unclear. It's bordering on the whole slander/libel thing, but
in general, truth is an absolute defense against a slander or libel charge.
What the actual truth of the matter is, I neither know, nor have any
real desire to investigate.
I was talking more along the lines of disclosing personal information without
permission, slander is another one as well...
I'm coming up empty-handed on statutes for the disclosure issue. Asking around
in the office found lots of rules that we as a university have to comply with
(mostly having to do with the information's status as "student records"), and
businesses often have privacy requirements (see HIPPA and similar, and
California has it's very recent laws regarding notification of information
disclosure due to hacking incidents), but I'm not finding any good cites for
"Joe User discloses Jim Random's info".
Tacky? Yes. Illegal? I'll wait to hear a citation (federal would be somewhere
in USC or CFR, state laws would be wherever your state keeps them - but making
them apply to an Internet incident might be tricky...)