You can sue the HR employee and the employer IF the employee was unreasonably careless, or negligent, in giving away the information (or if she did it deliberately; i.e. if she was a knowing accomplice); however, if she was reasonably careful and did nothing wrong, and the scammer did such a good job of posing at the president that the average reasonable person would have been taken in, she and the company would not be liable. Liability for an act like this depends on fault; the HR person must have been at fault in some way, and not taken in by an almost indetectible scam, for there to be liability.If there is liability, you can sue for any monetary losses but not for your time (there is no recovery for the time you spend dealing with problems like this) or the "mental burden," no matter how documented. In cases like this, only actual costs/financial losses can be recovered.