> an outsourcing company

From what I've seen, this is going to be a common subheading to a lot of these stories.

Business process outsourcing firm most likely (BPO). They get contracts for every kind of company you’ve ever heard of, lie about their cybersecurity practices, and then rebrand if they get caught.