One of the HR people's laptop was infected by malware.  The entire contents of the laptop was shipped off to a file sharing site.  It contained full payroll data dump.  Company did not choose to notify--claimed exemption as a government agency.;