HJK's entire staff should be informed of the investigation and of the disappointing fact that six members of staff handed over their logins and passwords

The investigation should be repeated in the future on a different sample of staff, using other reasons for asking for logins and passwords

HJK's response should be limited to briefing the six staff members on their error and ensuring that they change their passwords.

It was acceptable for the staff to surrender their details because the request had actually been made by members of HJK's IT Security Department.

It was unethical for HJK's IT Security Department to contact staff in this manner, lying about the suspected presence of a virus in order to provoke a response.