> Some of them just made stupid mistakes when they were younger

IMO intent matters, if they access a bank DB as a skill test (and disclose the hack to the bank) that's fine.

If they're taking a hospital offline for giggles they should get a record.