You can now view nation states, organized crime, and single actors as approximately all equivalent in capability, motivation, and disregard for any laws. So the distinction is not important.
Any of those actors can, will, and have used such data to meet their goals.
I agree. I think state actors obviously have much stronger technical capabilities and can operate with impunity, but a motivated actor can certainly achieve nefarious ends in most cases. Especially against a large public website where the attack surface is massive and the potential of a breach would provide a wealth of privileged information that would provide substantial motivation.
Any of those actors can, will, and have used such data to meet their goals.