IMO, companies should have draconian rules for this kind of corrupt shit - if that's the case. Fired on the spot. Clawbacks. etc.
If someone sold furniture from the office in the alley behind the office, they'd hopefully be reported to the police.
Surely this counts as "cybercrime". Unauthorized access to a computer system and all that.