Thanks you everyone for your information. Just some quick info.
1. They never called back and nothing has happened this far.
2. Our ISP provider did say the FCC called them (our real ISP client, of whom we've been working for years), and also says that he's required to send them monthly logs of our usage for a year.
3. I have since done some additional research, talked to a legal team, and they both agree, we've been possibly scammed.
4. I purchased a nice VPN (with a no-log network) just to be 100% sure.