There was no "hacking" taking place, and there was no single "hacker". The access to the page was done via a simple javascript change which caused a page to be opened that was online but not linked to by the BOS. This was the page containing the student's results.
Everyone who accessed their marks using a website created by the "hacker" did exactly the same thing he did. The only difference was that he worked out how, and made it into a website.
There is no way anyone could view anyone elses' marks without their student number and PIN.
There is also no way anyone could change their marks. No one had access to the database, only a HTML document generated from data within the database.
Changing marks would require _real_ hacking, ie. gaining access to the computers on which the database resides and then modifying it. Even if that did happen, chances are the database is only for web use, and that there is a secondary database which stores the results for other purposes (like sending to UAC).
What happened is similar to if I made a page online, but never linked to it or told anyone the URL. Then one day someone stumbles upon the page by "guessing" the address.
The BOS shouldn't have made this possible until Friday.