I'm still not sure it's a US count though. It would have to be prosecuted within the country that he made the 'statement' originally. And since he didn't NAME an specific institution personally, there is very little that can be done since there is no specifically named party to come forward to press charges.
Till he actually comes out and releases the data, and/or names specific corporate entities, officers or other such elements he's merely 'making statements'. No one has been named as of yet, so the threat has no direction as yet.
IE. Till he ACTUALLY comes out and does it, he's just 'blowing hot air'.