tldr: Two passengers had identical bags. Technically inclined passenger used the id number from other passenger's bag to get the other passengers phone number and exchange bags. Phone number was not visible on airline web site, he found it using browser dev console.

I'd hardly call that hacking, but then again my opinion often doesn't match up with what politicians and courts consider hacking.