As I understand it, only if they can prove some pretty intentional negligence. If some random dude sucks at his job and forget to encrypt so-and-so, or change the default password on such-and-such, it's not really the CEO's fault. Maybe you could chase after the CTO if they had policies which directly lead to this issue.
Again, just as I understand it, that's why nobody gets in trouble for this shit. It's not really fair to blame any one particular person. Whether or not that can be remedied by modifying the corporate system we operate in somehow, I don't know. Probably yes, but that's not my skillset at all.
edit: but in any case, this was due to people re-using passwords, so I doubt you could realistically blame the company.
Again, just as I understand it, that's why nobody gets in trouble for this shit. It's not really fair to blame any one particular person. Whether or not that can be remedied by modifying the corporate system we operate in somehow, I don't know. Probably yes, but that's not my skillset at all.
edit: but in any case, this was due to people re-using passwords, so I doubt you could realistically blame the company.