You could deal with the company or the FBI and "other agencies" - our world was pretty clear-cut and something we signed up to (literally).
Nope. If you work for a company that deals with PII and/or HIPAA information and something like that happens you certainly can be fired and even face legal charges.
National security data - absolutely legal charges, with the most extreme penalties.