It's not credible that the hacker saw the records and was "cautioned", as it's a criminal offence. Did the hacker see any other patient's medical records at the same time?
There has been no suggestion in any report that the person involved was a 'hacker', as that word is usually understood.
The person is a (now) former healthcare worker, who as part of their employment will have access to the medical records of patients in the London Clinic.
They have either accessed or attempted to access (the DM report uses both terms) the Princess of Wales' records, and have offered to sell the information to a third party.
The London Clinic itself reported the breach to the ICO, suggesting that it had very sensibly put a flag on the electronic record to detect any inappropriate activity.
The terms used in the ICO statement are 'deliberate misuse' of personal information and 'offer to disclose for financial gain', which could cover either having the records or only having attempted to access them.
'
the ICO issued a now former healthcare professional from London with a formal caution in relation to an offence under section 170(5) of the Data Protection Act 2018'
Having been issued with a caution means that the person now has a criminal record. This will be flagged on any DBS check. If they were in a role that required professional registration they will most likely have lost that registration.
The full ICO statement is here:
https://ico.org.uk/about-the-ico/me...atement-conclusion-of-criminal-investigation/