Per the Minister herself, this matter wasn't important enough to refer to the ICO, who are the correct people to deal with data breaches.

I've had to deal with the ICO over some pretty minor local government stuff, the bar for reporting to them is very low. I smell a coverup.