I've just started Darknet Diaries podcast. So great.
When I worked on electronic medical records, I assumed it was just a matter of time until we were hacked (too). All the most banal reasons: many vendors, shared passwords, root/admin access, etc.
I imagine things haven't improved much since.
In fact I’d say that sort of law breaking is downright routine. The key difference is the ability to afford a really good legal and lobbying team.