I can’t think of a jurisdiction where it would not be illegal. The “oh I was only testing your security” argument never works.