“Hacked” belongs nowhere in that title. Neither does “accidentally”, it was a coincidence or happenstance.
Non-clickbait title: “I bought a SIM card that was linked to criminal activity”.
It's even worse than that. He could have turned over the phone to local law-enforcement, or just ignored it, and bought a new sim. Instead he ends up giving security advice to this criminal gang. Like how much more irresponsible can you get?