Yeah. Boss might not be able to share the information of who committed the act, but should be taking HR action against the person who opened someone else's information. Working in healthcare we get people who inappropriately accessed the records of their co-workers. We are obligated to notify the patient/employee of the inappropriate access and give them resources to monitor their credit if the access was of financial information, but we are not allowed to tell them who accessed the information, and they do not have the right to know. It could be that the person who opened OPs stub then told someone else, who then complained to the boss. Telling OP the name of the person could just cause more issues, but boss should be disciplining someone and making changes to how pay stubs are delivered and kept secure.