alright, lawyer here
first things first, none of you are in any actual legal trouble, unless youre stupid enough to use any of those files to commit identity fraud
nothing was breached or stolen. the data was already in the public domain, with no protection under the terms of service of the "tea app." extremely amateurish oversight.
so, you cannot be charged with cybercrime. the only ones sweating bullets right now are the people behind this mess. lawsuits are definitely on the table since they created an illusion of safety for those who signed up and handed over sensitive data