In bigger companies, there are hotlines for employees to call. In local companies, you have to follow the chain of command, ie tell your superior who in turn should inform his boss, etc. But I would just pull the most senior HR person I can trust to the room of the most senior head of department you can trust and let loose the issue there. By having more than 1 party at the scene is important. By going to someone you can trust is important as you can hear from them their perspective on this issue before it gets blown out of proportion.
Sometimes telling the bosses of the person in question may not help as the boss might shield him/her. Also going straight to the top may also not help as he will most likely delegate to someone else to investigate which will then trickle down to others whom you may not want to be involved.
Only you would know the relationships of people in your organization. You need to determine the best course of action. Whistle blowers often take the risk of unnecessary danger. If the management wants to shield the person in question, you become the target of the firing squad instead. So be prepared else just play dumb and deaf like so many before you.