Btw- yes, HR and legal are not fun, but my worst one I had to have a call with an “incident commander” that sounded like
he was a former navy seal or something. He was all business and was very serious. The reason was that I meant to copy myself on a status update email with tons of proprietary information, but i accidentally CC’d my brother at his work email address instead (a competitor of ours). At the time there had been some high profile security incidents so I decided to self-report the incident.
After my call/interview with the Incident Commander, I then had meetings with legal, HR, and an executive VP. But truthfully, none of the meetings were harsh and I didn’t feel particularly at risk of any disciplinary action. They were all very grateful for the self-report and were just gathering info on how to best mitigate, including reaching out to the legal department at my brother’s employer to request them to permanently delete the email. But still not very fun to be the idiot that emailed confidential info to our competition.