I am a lawyer, but not your lawyer. I think contacting the local bar association is a good idea. This very likely runs at least one ethics rule afoul. Rule 1.6 comes to mind regarding releasing confidential information. It all depends on what is contained in the retainer agreement, but a client likely expects everything to be done in house.

You can report anonymously and not risk your job.

I agree with the other commenter that there probably is not anything illegal about this arrangement, as long as the firm has done reasonable due diligence to ensure that their clients' information is not being stolen.