Albeit he may be true, as the CTO he's way too optimistic beacuse he can't know, he can just assume! Just let the people understand (get to know) the problem and change the password, what's the problem?