Social engineering. Like, uh, solving his security questions to get into his accounts. Or seeing if he wrote his passwords anywhere. Or getting him to plug in something to his computer that steals his info.

Probably easier than hacking, but I can't recommend breaking the law. Haha.