I have been in a similar situation. I contacted my boss and the owner immediately (we only had 25 people). The owner handled everything, but he asked me to be available for a phone call. Since this involved a DOD contractor in the US, it was a DOD responsibility. We were never told the outcome.

Let the owner/COO/corporate counsel contact LE.

US LE loves to trap people for perjury. Always have a lawyer's advice and a lawyer present when you speak with LE.

Let the lawyers handle any screenshots.

Let LE notify other entities that their sensitive information has leaked.

I have been in a similar situation. I contacted my boss and the owner immediately (we only had 25 people). The owner handled everything, but he asked me to be available for a phone call. Since this involved a DOD contractor in the US, it was a DOD responsibility. We were never told the outcome.

Let the owner/COO/corporate counsel contact law enforcement.

US law enforcement loves to trap people for perjury. Always have a lawyer's advice and a lawyer present when you speak with law enforcement.

Let the lawyers handle any screenshots.

Let law enforcement notify other entities that their sensitive information has leaked.