They should fire the leaker, they have released personal and confidential information on a staye employee, as well as information on legal matter. Flood should also sue.
Need to make an example of the person because they did it with intent to harm the reputation of the school - that is about as malicious as it gets.