I think eventually the person responsible will be revealed. It's a big risk to take just to hurt a boss you don't like.
The problem comes in when a dissatisfied employee pulls such a stunt when they are about to leave the company.
I think everyone should have to take FERPA training. It seems to be generally assumed that we know this information.
