FIS Data Leaked

FIS, or Fidelity Information Services, had an employee steal confidential consumer information and sell it.  FIS has their official press release here.

What would happen if a CU employee decided that their member data was worth something and sold it?  How would or should a CU react in this instance?  FIS’ press release reads like it came from marketing, went to legal, and then back again.  Should CU’s issue press releases on their web sites, in their monthly newsletter(s), in a blog, or all of the above?  Are blogs appropriate avenues to communicate this type of sensitive information with your membership?