What would be the best way to handle this?
I think the first thing you should do is gather more information. You don't know who breached and why.
Here are some alternate scenarios:
- The webapp crashed and the order needed to be manually submitted
- The server was rebooted and the order needed to be manually submitted
- Employee purchases is a manual process and the order is actually an email the whole department receives
- Someone else saw your purchase and told your friend who pinged you
- HR has to approve the discount, so the information was extracted and shared with several departments
There are probably another five or ten reasons someone may have come across the purchase details during the course of the business process.
Once you learn more, then you can plot a course of action.
One thing I would not do (that most answers seem to indicate), don't go on the offensive with talk of data breaches and hr involvement until you learn more. Imagine how far you would swallow your foot if things are not like you expect.
Also, since the order is company data handled by company employees, I doubt it qualifies as a breach per se. If you start raising data breach alarm bells you may only serve to discredit yourself.