I don't think there is any conflict of interest. The police are only concerned with the criminals who stole the password. Whether the university owes the employees their pay because of the lax security they implemented, is almost certainly a civil matter.