One possible issue with a sacrificial-lamb / keep-it-quiet arrangement is that if there really are 100 cheaters, anyone who didn't cheat is in a position to be rightfully annoyed and cause trouble.
Might seem crazy, but perhaps take the public position that you suspect some unknown number of people cheated. Give no indication of the number. Emphasize you don't know exactly who. Re-test everyone regardless of whether you suspect them, "just to be safe". Explain they will be monitored.
That way you "did something" and aren't covering anything up in a way that can backfire, and have a response to customer concerns. "Few bad apples / took action to ensure integrity of certification"