This should be treated like any other data breach and employees should be reprimanded accordingly, especially for breaches of classified data (not sure if that ever happened, but I’m sure some dumbass has tried it).