does this mean this happened to a friend of yours who recounted the details personally to you first hand?

Yes. Exactly that.
As it happens, someone in a folk music related business but I'd better not mention names.
Somebody with a background in IT who wouldn't make basic security mistakes too.

Remember that identity theft is not usually about targeting a particular individual - it's about trying hundreds of potential victims and hoping you get lucky with one of them. One mistake by a lazy bank employee is all it takes.

Anahata