> Nothing will happen to these people.

Not true. They may end up putting out a press release explaining how "Here at Company X, we take security very seriously. Securing data is very important, and we will investigate ourselves to understand if we did anything wrong." So yea, consequences!