In fact, it seems straightforward to make a case against the student's activities. From the Computer Fraud and Abuse Act:
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—
...
(C) information from any protected computer;
The phone numbers are probably information from a protected computer.
Young people are pretty often cavalier about jeopardizing their futures. I'm just checking whether there is, in fact, a chance that this young person could have.
