There's a major, major hosting company whose server IPMIs all had an internet IP and used a default password for an unreasonably long time. I'm honestly not sure how this company is still around.
I'm going to be a little blunt, but the pattern of "there's a well-known company that's done something bad, you probably use their products, but I can't tell you what company because [I don't want to be deposed in a libel lawsuit / I want to feel intellectually superior]" is really long in the tooth, and doesn't add value to the discussion other than to pique everyone's paranoia.
https://docs.ovh.com/gb/en/dedicated/use-ipmi-dedicated-serv...
My only regret is that it took us so long to discover and switch to OVH - there are a few wrinkles but it’s such fantastic value compared with colo, let alone AWS/GCP/azure