OP I'm so sorry you're dealing with this situation.
I'm a contractor who has to be careful about data leaks for the companies I work with. I can't comment on your DH's situation but if his company has strict obligations to clients or regulators about data handling, then the way they are dealing with this is at this stage largely to cover their own arses.
There are probably mandatory investigations they must now pursue, which looks aggressive but is probably defensive rahter than personal to your DH.
Their first step was to terminate his contract, which was their quickest way to contain risk. A strongly worded legal letter was their way of signalling seriousness, protecting themselves, and creating a paper trail showing that they are doing the right things to address what they are contractually obliged to guarantee.
Unless there was clear malicious intent, they are less likely to pursue costs than seek assurance that the documents were deleted, not shared, and will not be used in his own business. It wouldn't be a criminal case unless he deliberately stole or sold data.
I know you're both traumatised, but take a deep breath. He doesn't need to grovel, just be straightforward about his mistake. Focus on transparency, cooperation and remorse, and be clear about providing the reassurances they need. Your lawyer will be able to help frame this for you as an honest mistake and clarify that he understands the policy breach, has deleted all materials, will not use or disclose anything, and is willing to cooperate fully.
The company is in "protect the business" mode, so in a way they're panicking as much as you are. Don't contact them directly, do everything through a lawyer - it will prevent misunderstandings and give the company the closure they need.
It's corporate risk management, not a judgement of his character. (Please try not to judge him either!)