depends ,its usually pretty difficult for instance if the hacker is overseas then it is difficult to take legal action , however in theory if your a UK site owner and a UK resident hacks your site then legal action shouldnt be too difficult but in practice the police/authorities usually have more important things to be worrying about