The argument is that the friend in question had no authorization to be sharing the password with anyone, violating the company's contract.

When you talk about violating contracts, that sounds like a civil matter, not criminal.