"how bad will it be for the company" is the wrong question to ask.

"what does the punishment need to be to prevent others from seeing it, and thinking it's a risk worth taking?" is a better one.

For me, I think it should be permanently revoked.