They're legal situation is that they have not paid what they owed, and have done absolutely nothing to pay back what they owe.
According to them they have been collecting personal information from their customers to follow government regulations, but somehow have no idea who they should have reported the theft to.
Does that make any sense?
Their legal situation is that vernon stole/lost your coins and ran away.
Yes they mismanaged customer money by either insufficient security that allowed a theft, or they may have actually stolen it themselves. If they were in fact hacked, they hid this from the customers and continued to accept deposits that they used to pay out withdrawals of other customers. They definitely should face criminal charges either way.