Especially since the "collusion" occurred after the breach.

---

I should probably mention that if getting this data doesn't qualify as "receiving stolen property," it should. The consultant could learn a lot from Pepsi ( https://www.theguardian.com/media/2006/jul/07/marketingandpr... ), but there is a difference between coordinating with somebody to steal data and getting data that has already been stolen.