When you're trying to plug illegal leaks you look for those that are leaking. Once the leaks slow, you have to watch carefully for any new leaks. If found, you take strong action to stop each new one. The people doing the leaking HAVE to be progressively disciplined (federal rules) if it was an oversight, the info slipped out, or something other than plain old sedition happened. Sounds like that employee just f'cked up and let something slip. Suspension is an appropriate 1st disciplinary action.