I agree, this was not the work of a super hacker….but it should still serve as a warning to those who have privileged access to vulnerable people’s data.
I would hope that all organisations who have this kind of a access to data, think very carefully about their recruitment procedures and how they would detect a member of staff carrying out this kind of low tech collection and distribution of data.