W-2 Laws regarding willfully giving them to the wrong person

In early 2023 I left a very toxic, disorganized, and horribly ran company for a much better position. Tax season is here now and I’m expecting my W-2. Just got told by my close friend/ex-coworker at said company that when he stopped by to pick his W-2 up they gave him mine as well without him asking, and asked him to give it to me.

1) is this illegal or punishable in any way (to the company, not my friend) for giving my personal information to someone that isn’t me

2) if so, how would one report it and to whom?

I’m relieved my friend isn’t a scumbag and took care of me, but what if we had a falling out? What IF he was a horrible person and just stole my identity and disappeared? The idea just pisses me off that they would just give away my social security number like that.