It's definitely a GDPR breach, but it may not necessarily be reportable to the data regulator. Imho it should definitely be reported to the data protection officer first before going to the regulator. Most frontline staff have no idea how to handle GDPR queries or issues, but it's the designated data protection officer's role to be responsible.