We have a local fileserver on premises. It appears a manager synced his cloud storage account to a folder on this server (in a location that's not very hard to find). This folder is now accessible to anyone in the company and contains an Excel file called 'Salaries', in which the salaries of the employees of a certain department are listed. This is not the first time this manager has done this - on the same server I have found a file which contains feedback and evaluations of employees.
What steps could or should I take? Do nothing and stay safe? Notify HR or Infosec (we have people dedicated to this with GDPR coming up)? Should I do this anonymously? Or maybe I should just straight up inform the manager himself?