Since this was done inadvertantly (i.e. with no wrongful or criminal intent), there would be no criminal liability. In terms of civil liability (e.g. being sued), lawsuits have to be for actual losses or damages. So if any of your employers suffer identity theft and lose money (e.g. have anything stolen; have accounts opened in their name; etc.), they could potentially sue for the loss; but if there is no actual harmful consequences, there is nothing to sue for. So unless you want to proactively try to shield the employees from suffing identity theft, such as by paying for one of those identity shield services for them (which may not be a bad idea, since if you can head off any losses, you avoid liability), there isn't really much of anything you can do, other than wait to see if any of the employees do sue you for some loss traceable to this.