Unless a single person decided to go completely against what they are told and did something bad all on their own, then yes, it's always the CEO/CTO fault.

That shouldn't be an alien concept.