I'm trying to parse exactly what happened here. The way I understand it is that forks of private repos stay private. So did the contractor fork, clone, and then push it to a separate public repo? That has lawsuit written all over it...
as far as I know, the contractor is based in some other country. Not sure about international laws here.