An Organization's Privacy Officer Was Just Notified by the Benefits

An organization's privacy officer was just notified by the benefits manager that she accidentally sent out the retirement enrollment report of all employees to a wrong vendor. Which of the following actions should the privacy officer take FIRST ?

A) Perform a risk of harm analysis
B) Report the incident to law enforcement
C) Contact the recipient to delete the email
D) Send firm-wide email notification to employees