In short, the issue is that the manager didn't keep to the schedule. If they had done it at the proper time HR would have been involved and we would have gotten

In short, the issue is that the manager didn't keep to the schedule. If they had done it at the proper time HR would have been involved and we would have gotten our notification. Instead the damage was done hours before this was scheduled to happen. In terms of higher-ups notification the "oh shit can you recover this" call came from the CEO I don't know what happened to the manager. I can't imagine it ended well for them, pretty much that entire section of the org was on thin ice (acquisition that didn't want to absorb into the company) so I can't imagine it ended well. I know we didn't pursue legal action against the ex-employee, which pissed me off at the time, but I can see the logic in leaving it done and dusted. The only PHI the company held was what HR had on it's the employees, so not at risk here.