The hacker did use a VPN, but they also posted snippets of the stolen data online, possibly to brag or find potential buyers, that eventually led to their real

The hacker did use a VPN, but they also posted snippets of the stolen data online, possibly to brag or find potential buyers, that eventually led to their real identity. VPN isn't cruise control to anonymity. Being based in a country without an extradition treaty to the US probably offers much better protection e.g. Russia, China.