I once encountered a similar situation. A technology I inherited had been configured in a way that people outside the company could access the technology for criminal use. If this happened, the company could incur a substantial financial liability. The technical staff discovered this situation while replacing the hardware with newer technology. They reported it to me as their manager. I suspected that it was originally set up so that some employees could use the technology as a personal benefit with no record of the benefit being reported. But I had no hard evidence of this. I was very nervous about bringing the issue to my boss. How a company handles raising these issues tells you a lot about the values and integrity of a company's executives. I recommended to my boss that we reconfigure the hardware to prevent access from outside the company. Fortunately for me, he agreed and the matter was settled with integrity. This boss taught me what he called "The Newspaper Test." It goes like this: "If your mother were to pick up tomorrow's paper and read about your handling of this situation, would she be proud of you?"
We have the potential in our professions to encounter unethical and illegal uses of technology and data. We don't have to go looking for them; sometimes they just fall into our laps in the normal course of our work. The question is then, "What do I do next?" The answer may be simple or complex. But even if the answer is plain, it may not be easy to do.