I haven’t read the article, but maybe they don’t use electronic records for the Royal Family, so someone was able to photocopy some written notes?I don't believe this story as told. Someone cautioned who "had possession" (printed?) of her medical records and planned to sell them, had maybe shown them to a buyer? Who else had seen them? This report imo is in response to something else that they thought would go away and hasn't, or it didn't happen and the story of the "caution" is to downplay the hacking to the level of a parking-ticket for a specific reason. Nothing to see here, move on.
It's not credible that the hacker saw the records and was "cautioned", as it's a criminal offence. Did the hacker see any other patient's medical records at the same time?
From the report
"The ICO, which is the UK's privacy and data protection watchdog, said a caution was 'the appropriate and proportionate enforcement response'.
'Based on the evidence available, we did not identify any failings that would meet the threshold for regulatory enforcement.'
Hope all goes well @flugella