All he did was order extra tests which were sent to the school district warehouse. They caught him when they noticed them, and viewed the order form.
It’s an embarrassment, but the kid did not breach the security surrounding the test contents.
He breached mailing access security, and was within one more step of being able to redirect a mailing to another location, which would have enabled breaching test contents. In fact, he may have been able to redirect a mailing, and simply chose not to, because the primary breach was his only hacking goal. All in all, it was more than a mere embarrassment, I think. More like a bitch slap, considering his age.