Whoever was doing the websites (they were all done by the same company) published them to the public when they never should have been. They should have been created on the backend and published when they were done.
IMO the CEO knew nothing about it until he was contacted. He then contacted the team and probably yelled and cursed loudly.