I have been in a similar situation. I contacted my boss and the owner immediately (we only had 25 people). The owner handled everything, but he asked me to be available for a phone call. Since this involved a DOD contractor in the US, it was a DOD responsibility. We were never told the outcome.
Let the owner/COO/corporate counsel contact law enforcement.
US law enforcement loves to trap people for perjury. Always have a lawyer's advice and a lawyer present when you speak with law enforcement.
Let the lawyers handle any screenshots.
Let law enforcement notify other entities that their sensitive information has leaked.