How should HR deal with the fallout of a data scam?

Communication is the mantra that HR must adhere to when mistakes are made.

However, this isn’t always the case. KittenTitterBums took to Reddit to bemoan that their employer's HR department had fallen foul of a “phishing scam” which resulted in them sending “50 employees’ tax info to some fraudster yesterday.”  

They went on to say that the company had not notified everyone officially, and asked for further help.

mlp-r34-clopper said it wasn’t a mistake, but negligence: “[It]'s just plain negligence, for [them] to fall for a phishing scam.