"All employees who have accessed the account — whether authorized or not — have been put on immediate leave, with pay," McAdam said. "Employees with legitimate business needs for access will be returned to their positions, while employees who have accessed the account improperly and without legitimate business justification will face appropriate disciplinary action."