This is what I'd do and check:
(all of this is dependant on how paranoid you are and how confidential the data really is, translaten for the next ueber-web-facebook-flash-game aren't quite as confidential as say translations for legal parties that are planning to have some international drug raid and need to pass information around)
- First and foremost: Invalidate all URLs that have been sent out
- Password protect everything but don't tell anyone the password
Things under your control
- was the message really encrypted (maybe just signed)
- check the machine that did the encryption for malware (was it some gateway that is publicly reachable, was it "real end to end encryption)
- someone got access to the private key without using malware:
- repeat the process and check logs
- repeat the process with a new key and check the logs - tell recipients about the new key
- repeat the process with a new key and check the logs - don't distribute the new key
Things not under your control
- malware on any of the recipients machines
Find out who's the bad guy
- send a unique so called secure URL to every person in question unencrypted
- send a unique so called secure URL to every person in question encrypted -- this is actuall optional
(sorry but sending out an unprotected URL by GPG is just about the same as sending out a protected URL in plaintext -- script kiddies will find that stuff -- also protecting on the server side is in my experience more valuable for a business since you have more control)
I had a friend very proud of consistently using PGP for all his mail converstations. That is ntil he found out that he accidentally had exported his private key and kept sending that around all the time instead of the public key -- funny at the time, but you never know what hits you (now it wasn't me, I'm by far to lazy to encrypt my mails with PGP and explain it to customers, I usually use some encrypted ZIP-file or something else that is useable by non-tech people without explanation)
Implement one-time-passwords for your translators. Send them the new stuff by snail-mail.
Also, I assume you have a written consent about not giving stuff away and you are absolutely sure that it wasn't by coincidence someone with some technical background that scripted receiving encrypted mails and automagically does some other stuff.
Also (again), any possibility that any of the recipients have subcontractors that do the actual work and the mail got forwarded (possibly with the key needed to decrypt it)
Last but not least: There's this thing called mobile access, did you give everyone a call to make sure it wasn't valid access from somewhere you haven't expected?