No doubt the provider of info is culpable but that doesn’t resolve the receiver of such from culpability - especially if the receiver was seen as a confidant.
Nonetheless, people within any organization privy to sensitive info should have enough integrity to keep that info close to the vest in...