As the technology person, I'd have to fully document how the disclosure happened, find the reason why it happened and identify what we did to protect ourselves. If we could identify what was stolen, the business side would work with each customer, giving them advance notice of what steps they could take to protect themselves on an individual basis. I'd also use technology to generate evidence. If you were storing credit card data, you'd have to have mechanisms to log that data. The very first response would be a purely technical one - to determine what happened and why.
Someone breaches security and gains access to highly confidential customer information.
Your own investigation indicates it's an inside job. The first step would be to determine the severity of the problem and make sure there are legal grounds to investigate the problem. If you concluded the problem was intentional and severe, you'd want to handle it very tactfully and do it on a personal level. But what you could do up front is focus on recruiting to make sure you hire very competent, reliable and ethical staff, and then treat them fairly. If you have a good working environment, I think you can avoid this in the first place.