One time our HR rep sent out the entire company's roster of employee names, personal information, salary etc. It was immediately followed by a "please disregard and delete the previous email", but by that time the damage was done.