I'm trying to parse exactly what happened here. The way I understand it is that forks of private repos stay private. So did the contractor fork, clone, and then push it to a separate public repo? That has lawsuit written all over it...