IT student Chris Brown obtained the pictures from the club's official website as it was being updated and published them on Twitter and internet forums.
Brown did not hack the website but rather was able to take the pictures from a page that was being worked on.
The season ticket holder said he was sorry for upsetting his favourite football team.
"I'm sorry for any offence I might have caused to the club, but I would never do anything malicious or spiteful because I do have an interest and love the football club," Brown told the BBC.
Norwich phoned Brown at 04:30 on Wednesday morning asking him how he obtained the pictures before informing the police.
"I feel Norwich could have handled it better," said Chris's mother Trish.
"I feel they could have spoken to Chris and myself... and just discussed why he'd done it, asked him a few more questions, before involving the police.
"He knows he's probably done wrong by taking it a bit further, but that was just excitement to show other people what he had done."
Norfolk Police said in a statement: "We can confirm we are making inquiries into a reported electronic security breach. A 17-year-old boy is assisting us with our inquiries."
The club's chief executive David McNally explained why the club involved the police.
"We are the guardians of the football club whilst we're here and so we will protect our property," he said.
"Our property in the digital age involves our intellectual property, so we won't allow anybody to come in and take it from us."
McNally also defended the club's decision to launch a new shirt after using their current jersey for just one season.
"Let me tell you, big football clubs change their kit every year. If we are a big football club then we have to act like a big football club," he said.
"If we don't, we are at a competitive disadvantage to other big football clubs and the vast majority of supporters prefer the kit to change every year."