I never had an old employer accuse me, but I did have a consulting client do almost exactly the same thing. It boiled down to a few people at the company that

I never had an old employer accuse me, but I did have a consulting client do almost exactly the same thing. It boiled down to a few people at the company that didn't like that we pointed out a lot of security issues on things which were not our direct work but was theirs. Basically we found a few major holes in a couple of their systems we had to do some integration work with and we documented the holes and gave it to the company as part of our deliverable. Well like after 6 months post our exit they had a breach through one of those systems. One of the PM's and a couple of devs accused my team of the breach because someone had used one of the open doors we identified. Literally they had an open port through the firewall to a database system that was unprotected (no password even) and had client data in it, yea Mongo's stupid default no user/password back then. Essentially I did the same thing you did, reached out to the CEO, he denied they blamed me or my team and said there was nothing he could do about a few "bad apples" running their mouths. I disagreed and pointed out that what they say in a professional capacity about myself or my team as a result of our time there was something he can and should concern himself with. In the end, I did what everyone here is telling you, get a lawyer. It cost me ~$500 to protect our name and put an end to it, essentially we sent a cease and desist letter and a some wording on potential damages given our work and what was being said. That letter only got one response which was they had addressed the employees and agreed my team had nothing to do with their breach. That was all I wanted, and it is what you should get because if it ever comes up you can show that to whoever asks. Took less than a week to resolve and we did work for that company again like 2 years later, guess who no longer worked there, the "bad apples" were all gone, but most of the rest of the team was still around including the CEO who brought us back. So it didn't cause us any damage long term with anyone other than we probably pissed off a few people that were already running their mouths a bit. One last point. I have had people bad mouth me for a number of things over my career. Not once did it ever really hurt me professionally, mainly because I had a track record showing none of what they said was true. As a consultant I had lots of people pissed saying we were there to displace them, replace them etc etc (even old developers saying that cause they had ancient skillsets). I had articles in a few papers how we were destroying jobs through automation of services of a long term employer in a small town. None of it hurt us, it hurt our pride/feelings a little cause we knew what they were saying was false, but in the end none of it ever affected us professionally. In some cases it actually helped us get other work partially because people saw we didn't react and get defensive or go off the deep end. I am not advocating you don't defend your professional reputation, but just realize there is a time and place to, and a time and place to just let it drop.