Maybe it was the intern's fault to set a weak password but it is the CEOs fault for setting up an organization where things like these can slip through security review or monitoring.