In Norway, we had a case in 2018 of a minor finding a spreadsheet online with usernames and passwords for most teachers and students in the municipality's school platform. He had some missteps after trying to report the issue and not being taken seriously, ended up logging in with the credentials of the headmaster and sending a stupid message to everyone. The municipality involved the police, and the police "raided" his house and took some of his computers.

Fairly big controversy in Norway. Bergen (the municipality) showed incredibly bad faith and the worst possible judgement. "Datatilsynet" (Norwegian Data Protection Authority) gave them a decent fine, and Bergen showed no humility, opted to dispute the fine as if the fact that a kid finding everyone's usernames and passwords was something that was a daily occurrence with no more significance than spilling coffee on one's shirt.

https://www.nrk.no/vestland/datatilsynet-star-fast-pa-millio...