This is the equivalent to the periodic scenario where HR accidentally emails the spreadsheet with everyone's salary numbers to the Everyone list.
And yes, back in the days I was an email administrator, I had to try and do damage control on someone who had actually done that. Twice.
Yep - happened at my job as well. Someone in HR attached a wrong spreadsheet to an email about the company picnic. The spreadsheet had our salary, address, dob, and social security number.