Fi 🏳️⚧️So, I haven't seen anyone else remark on this yet, but -
if they got into his gmail, then they presumably had the ability to get into his google account -generally-, including things like "backups" and "findmyphone."
Consider the level of exposure involved here, and the complete silence on -how long- they had this access.
Consider how many emails they could have sent from his account too.
And how many other places he used those login credentials.
You know, if they had access to his phone and the ability to install apps, there's really nothing stopping them from using his phone to connect to whatever local wifi and gain access to resources on that.
I wonder how many networks his phone was a trusted device on.
'cuz if I were a competent threat, I'd only release the taunting document dump -after- I'd used his phone to establish footholds in various otherwise secured networks persistently.
I'd make a joke about 'more lateral movement than' some football team or other but I don't know what team is currently reknowned for throwing lateral passes, so assume I did the clever thing.