Agree on all the above, but wanted to add that "planning for unexpected transparency" isn't a bad idea. Keep only the data you need to keep, play fair with employers and customers and vendors, and be ready to deal with the "how" the leak happened more than the "what". I personally think managers should know what their team makes and I don't think it's wrong/unexpected to have someone on the team that makes more than a manager, in part because that's just how life works and in part because most managers are eligible for performance bonuses beyond those offered to team members (I hate to use the 'individual contributor' phrase!).

It does make you appreciate - all over again - how hard security is when you have the big dog plugging in an unknown drive.