First: I am not a lawyer and this is not legal advice. Also, I assume for the purposes of this answer that the company is both a controller and a processor of personal data. (for Definitions see Art. 4 GDPR)
Does it need to be reported?
In case of a personal data breach, Art. 33 (1) GDPR says the controller needs to:
[...] without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority [...]
If you look at Art. 4 (12) GDPR (Definitions), you'll find personal data breach being defined as follows:
(12) 'personal data breach' means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Art. 33 (1) GDPR goes on to say:
[...] unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. [...]
You may also be interested to know that a processor is required by the GDPR to "implement appropriate technical and organisational measures" (Art. 32 (1) GDPR) (sometimes called TOMs) to protect the rights and freedoms of data subjects. This includes "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident" (Art. 32 (1)(c) GDPR)
So in short, it really depends on how sure the controller is whether there was ever a risk to the rights and freedoms of the data subjects.
I can't judge that risk in your case, but given the nature of malware, you know, I would be pessimistic.
What responsibility do individual employees have?
That depends on a million things, I don't want to make a prediction as to what will happen if the individual stays quiet.
If the company has a data protection officer they would be a good person to talk to. One of the tasks of a data protection officer is "to inform and advise the controller or the processor and the employees who carry out processing of their obligations [...]". (Art. 39 (1)(a) GDPR) While the DPO can sometimes be an employee of the company, they have a duty to the data subject and will avoid a conflict of interest.
If the employee fears getting in trouble with their employer for reporting a possible violation, well, that fear may be justified. It's been known to happen. It's of course possible to talk to the DPO anonymously (although the employer may still be able to figure out who it was).
If you ask this kind of question on the internet, the first response will always be "talk to a lawyer now!". That is of course the best possible advice, but sometimes you may be in a situation where talking to a lawyer is infeasible. With GDPR violations, luckily you have the DPO and the supervisory authority on your side, they will talk to you for free.
Also consider just reading the GDPR (the actual text, not articles about it). It looks scary, but it's not that difficult to understand and it's not that long.
Lastly, specific questions about local laws can be posted on https://law.stackexchange.com/.