By itself this doesn't mean he was directly compromised. We need to be really careful about inferring things from presence on these stealer lists and breach tracking sites. This is the second time in the last couple weeks that I have seen a "stealer" list being used to discredit someone.

You can easily end up on these without having ever had a directly compromised device of your own. If you have an email password combination that was breached in any of the many public breaches listed out there (see https://haveibeenpwned.com/), all it takes is that credential to have ended up in the list being used by another nefarious actor to attempt attacks on new targets.

These are public lists, and if an attacker is using that list to attack another target, and the attacker's machines are also compromised (if you lie down with dogs, you get up with fleas).... that's it, you are now potentially in that list associated with other services than the originating service. It doesn't mean anything other than you had an account with a previously known password from a breach.

So yeah... it might infer this guy's opsec is terrible, It might indicate he was hacked, but it just as easily---and probably more likely--- might indicate nothing other than he was a victim of a 3rd party breach (like almost all of us who have been around a while will have been) and then someone else using that list was hacked... E.g. a password on a throw-away website/forum 20 years ago that was breached, forever plays forward in future attacks based on those lists. It appears as a new compromise, when it isn't.

From TFA..

"
As Lee notes, the presence of an individualâ(TM)s credentials in such logs isnâ(TM)t automatically an indication that the individual himself was compromised or used a weak password. In many cases, such data is exposed through database compromises that hit the service provider. The steady stream of published credentials for Schutt, however, is a clear indication that the credentials he has used over a decade or more have been publicly known at various points.
"

If you're that wealthy, you're sending your kid to Yale to meet future employees (the smart, hard-working, non-legacy students) and future partners (the rich, legacy students of arbitrary skill).

Great idea; no notes.

I also wonder how much it would cost to have the flight deck track location based on gps _and_ location based on an inertial reference system; then perhaps warnings could be provided if those locations diverge, and the pilot could opt to use one, the other, or neither as appropriate.

A super high-end inertial reference unit is in the hundreds of thousands of dollars, but I'd wager that something good enough to get you to the other side of a war-zone should be feasible for low five figures; maybe less if it could reuse components from cars or mobile phones.