If they compromised the data themselves, yes this is illegal. In the UK there is the computer misuse act, in other EU countries there are slimier laws thanks to the EU. For the computer misuse act in the UK, section 1 states "A person is guilty of an offence if he causes a computer to perform any function with intent to secure access to any program or data held in any computer [and] the access he intends to secure is unauthorised; and he knows at the time when he causes the computer to perform the function that that is the case"
I am unsure if there are any laws regarding handling data gained in an illegal manner but there are likely to be some. (likely to be in data protection act)
I would like to ask that you not not hold the person/company who emailed you responsible, they are doing what is known as responsible disclosure, where they are telling those involved that a breach has happened, most likely by another party. It is healthy for people to shout about insecure systems because that is the only way they will get fixed. If google find a broken system they tell the company it is broken and then give them a week to fix it before telling the world, even if it is not fixed.
If your medical details were left in view of the window, someone is trespassing and looks into the window and tells you that your details were visible, who do you blame? The trespasser who shouldn't have been there or the doctor for leaving your data somewhere insecure? Both parties are responsible, the trespasser for trespassing (or in your case unauthorized access to your data as mentioned above) and the doctor for not securing your personal data (Data protection act SCHEDULE 1, part 1, no 7, "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.").
Any company worth dealing with will not have access to your password, only a representation of your password (think of your password being 5x6, the company would store 30 because it is easy to get from 5x6 to 30 but hard to get from 30 to 5x6) This is step one two how to store passwords (step one is try not to store passwords eg. sign in with facebook, google etc.)
I know of a company in the UK who were given 30 days to secure their system otherwise they would be getting £5000 per day fine due to data protection laws. It is the company's responsibility to secure your data.
Hope this helps. If you want to see if your details have been compromised elsewhere https://haveibeenpwned.com/ is a service that you put your email address in and it searches its database of breaches. It is run by a well respected security researcher who is very responsible with the data he holds.