Some kind of sanction is probably needed, but I don't think this rises to the level of firing/prosecution.
Even if it was straight up a bra size rather then body armor, that doesn't fall in the category of "Sensitive Personal Information".
It's, at most, embarrassing.
Addresses, SSN's, health records, bank account numbers.* Those are all "Sensitive Personal Information". My size 38 boxer briefs? Not so much.
*I picked those because fed.gov has lost all of that information on me. No one's been fired yet.