Why does someone at this organization think that filing a police report is the appropriate action. It fairly well guarantees that no one else will let them know the door is open in the future, and it highlights to adversaries that there is a good chance this is an easy company to find a weakness in.
As an aside I see this as a side effect of increasing layers of abstractions between law/society and technology. A tech manager goes to legal to let them know that a former employee has just let them know that there was a security breach. Without understanding git, github, responsible disclosure or programming, all the lawyer hears is that a former employee has written to tell us that he has found copies of sensitive information and has encrypted them on his hard-drive.
If you are the legal representative for a technology company, at what point do you have a responsibility to understand the technology?