Why are these things always so hard? Why bring a lawyer (who will charge money fo his services) in own it?
This is an awfully embarrassing situation for the company he's working for. They could decide to cut their losses and turn him into the police, betting that public outrage will focus on the malevolent thief instead of on their innocent security mistakes.
Or, if they're more worried about their liability (possibly including liability for theft already committed by less scrupulous employees or consultants,) then one way to sweep it under the rug would be:
1. Produce a serious and viable legal threat against the poster.
2. Use the threat to make him sign an agreement never to speak another word about their credit card problem.
3. End his contract.
4. Go on with whatever they want to do (fix the problem, or not) with much greater confidence that this will never publicly surface and bite them in the ass.
That wouldn't be a catastrophic outcome for the poster, but even in that situation I'd rather have a lawyer advising me.