Yes, that the cybersecurity firm found a big enough trashfire that they don't want their name associated. If there were a competent security firm, there would be a detailed timeline (perhaps not in this post, but linked from it) of "Hacker got access, did X, Y, Z. Last access using compromised token was at A and token expired automatically at B". The other alternative is they hired Kaspersky and don't want to mention that for obvious reasons.

If you are still on Okta in a month, you should be held criminally liable when the next hack happens.