I find it a little strange that they outsourced penetration testing like this. (Although maybe they already understood the system's vulnerabilities and wanted to see how hard it was for someone else to do it.)