They conducted an employee survey where someone admitted the company name being a substring of a password they use.
They used some rudimentary bruteforce methods which matched salted registers or logins (say “Company name123456”.)
Instead they meant that it is possible to create passwords with the company name in it, but transmitted it poorly.
Some of the passwords are unsalted.
The passwords are logged somewhere else.
It goes without saying that if they found a vulnerability with the hashing or salting, it should be highlighted on its own, and in any case it wouldn’t do damage to ask them directly.
My guesses would be that either:
It goes without saying that if they found a vulnerability with the hashing or salting, it should be highlighted on its own, and in any case it wouldn’t do damage to ask them directly.