Context:
I made a mistake last week and sent the wrong data (including other manufacturers' data) to them due to a copy & paste error in Excel. Yes, the sensitive data shouldn't be sent using a copy&paste system in the first place. I didn't realise I'd made the mistake until the manufacturer emailed me the following day.
Thursday
So I made the mistake of not telling my boss as I didn't realise the consequences of the mistake nor was I aware of any procedure or system in place for a data breach. I had not been trained in this manner and this is my first role / first time this had happened. I recalled the email and the manufacturer said he and his colleagues would delete the email. It was a very important day of the month for me, so I was focused on completing the reports due that day - again overlooking the implications of it.
Monday
Following this, I received an email from a senior manager (my boss' boss) asking me to provide details regarding this breach - I was honest and told him what happened. I presumed senior management knew of the issue and were dealing with it.
I then had a call with that senior manager the same day to provide more details on it, where he reassured me that it's not going to mean anything for me and that it wouldn't be an issue - therefore I thought it was already dealt with and didn't consider telling my boss (who was on holiday this day).
Tuesday
My boss lights me up over the phone for not telling him of the issue, when I was surprised because I thought him and the senior management already knew about it - yes, it was a mistake not telling him, but he really went off on me.
He then asked me to write up the series of events in which things happened, which I did and then revoked my visit to the work business review (today) and is now checking any external report I submit.
Today
He is now asking me to provide a reason (over email) in writing why
- I didn't tell him initially
- I didn't tell his boss initially
It seems a bait to try and get me written evidence to be released from the company. I know I made a mistake in not saying anything and that is my fault, but I was overwhelmed in the day with other tasks, not trained in data security, unaware of the procedure in place in the event of a data breach and already thought it was being dealt with by the senior staff who contacted me and who I provided information to.
This is my first job. I'm 22 and am worried I'm going to lose my job over this mistake.
What should I reply to this email with / what should I do?