It's almost certainly not legal (it could probably be tried as fraud), and it definitely is a breach of contract for the CISO. I'm not claiming it happened, I have no idea, just commenting on the legality of the claimed acts.