If they compromised the data themselves, yes this is illegal. In the UK there is the computer misuse act, in other EU countries there are slimier laws thanks to the EU. I am unsure if there are any laws regarding handling data gained in an illegal manner but there are likely to be some.

I would like to ask that you not not hold the person/company who emailed you responsible, the people responsible are the company who you have an account with. Any company worth dealing with will not have access to your password, only a representation of your password (think of your password being 5x6, the company would store 30 because it is easy to get from 5x6 to 30 but hard to get from 30 to 5x6)

I know of a company in the UK who were given 30 days to secure their system otherwise they would be getting £5000 per day fine due to data protection laws. It is the company's responsibility to secure your data.

Hope this helps. If you want to see if your details have been compromised elsewhere https://haveibeenpwned.com/ is a service that you put your email address in and it searches its database of breaches. It is run by a well respected security researcher who is very responsible with the data he holds.