Inform the IT team. This is potentially a data breach.

There are a number of regulations put into place around the handling of personal information, including things like the GDPR in Europe. I would recommend contacting the individuals responsible for handling compliance with these regulations in your organization so that this can be handled appropriately and in compliance with any relevant regulations.