He didn't have to. We're talking about the real world here, not kindergarten. If he absolutely had to go public, he could at least anonymize the data before handing it over to a journalist.

Then just redact it. Remove sensitive data.