First, to answer your question of whether this is a data breach, it absolutely is per GDPR. The GDPR definition of a "personal data breach" is the below. Personal data is defined broadly to include data that identifies a natural person using elements such as name and factors specific to the economic identity of a person. I interpret "economic" to include employment history.
personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
You have not asked for this, but I will share with you some best information security best practices that hopefully can mitigate a similar incident occurring in the future.
Least privileged access
Least privileged access means that only people who need access to a particular asset (such as this data) to perform their job are granted access. Apparently in this case, this best practice was not followed because users having no legitimate business need obtained access to highly sensitive data they should not have had access to. You probably do not know for certain how long this data was exposed on the network share, and whether this data was already exfiltrated / otherwise misused.
Going forward after this incident, it is probably worthwhile to perform a through access review of users and exactly what access they have to data. To go along with this activity, designate a limited number of data custodians whose duty it is to safeguard access to such data. To obtain management buy - in, you can use this incident and its potential impact to company (fines, lawsuits etc.). Assuming management is rational and reasonable, they should care.
Data labelling and classification
It is best security practice to classify data based on its sensitivity, with one consideration of sensitivity being the potential adverse impact if it were to be compromised (as it was in your case). Your company is fairly small now at 120 employees, but as it expands, maintaining proper governance of data will tend to be more important. Depending on your standing and role in the company, suggesting improving the classification of data may be something to explore with company management / your manager.
This does not have to complex effort, and a data classification scheme as simple as public vs confidential data may suffice. Regardless any decisions should be documented and signed off on by management in a policy document made known to all stakeholders.
Security incident response and data exfiltration detection
In this case, the security incident was brought to your attention by your colleague. Informal methods of notification may work when organizations are immature, but as companies grow, it's almost always beneficial to establish formal procedures for identifying, containing, remediating, and reporting security incidents to company management from my work experience. As part of the security incident response procedures, there should be means, such as DLP, to detect the unauthorized transmission or disclosure of company data.
Encryption of sensitive data
Depending on your threat model, the value of this data to management, and technological capability of your company IT, you may want to think about encrypting such sensitive data, so even if individuals gain unauthorized access to it, they cannot read it. If you decide to go this route, below are some best implementation practices:
Use a secure encryption protocol such as AES or RSA using a long private key length to make decryption by malicious actors as difficult as possible.
Establish procedures and controls to safeguard the decryption key such as through split knowledge or control
Rotate the encryption / decryption key periodically or whenever you suspects its compromised
Keep access to the encryption key to the minimum number of custodians that need access to it to perform their job duties.
