Data breach?

[Serena1977]

I emailed a company about a refund and the person replying attached something very sensitive to the reply that was nothing to do with my question. Eg someone's address, d.o.b.,school grades, phone numbers etc. like a CV type document.

Is this a data breach? And if so who do I report it to?

Just reply that you believe a document was attached in error and inform them you have deleted said document.

Yes this.

Agree with pp.
Sometimes a mistake is just a mistake.

This. Humans make mistakes sometimes. You do, we all do.

Agree with all of the above.

In fact it's probably their own info, unless they work in the h.r of the company as sounds like a c.v?

Check their website or call reception and ask who in their business is responsible for data protection.
Report it to them, it needs investigating.

The ICO deal with data breaches but I'd let the company deal with it themselves as a first step.

Just email back letting them know . I presume the information meant nothing to you and you won't be using it for nefarious reasons. The persons blood will run cold and they won't do it again.