I don't see a way to recover frankly

Their existing customers are seriously exposed, i don't see this going anywhere except court

The problem is the malicious intent, you just can't do that anywhere, esp not in a trust based business..

Also: you'd expect a compliance company to understand basic software licensing, especially the most popular.

The problem with Apache 2 is it might not be completely clear how this works with a Saas product. Of course if you are distributing binaries or source to customers then you are going to run into issues with Apache Licensing. But if you are just running code on your servers then its not so straight forward. However, I guess its likely they were distributing javascript code so that could be a problem for them. Also, I guess regardless of the licensing issues not being honest with your customers when you are a compliance company is not going to be great for business.

I love the spin:

  Rebuilding our auditor network and removing firms that don’t meet our standards

Not "finding new auditors to replace those that want nothing to do with us and our standards were shite"

wasn't there some meme that 30u30 was some kind of predictor for fraud

I also assume these damage control type missives to be very misleading. Seen so many of these on HN over the years.