Certainly it could. Or that there is a malicious clone site out there that several people are stumbling across. I always suggest people should use Core or Electrum over bitaddress or any other website in order to generate wallets.

There are plenty of other explanations for the pattern of transactions see though. Perhaps several other people at OP's company also generated paper wallets using bitaddress, which were then stored on some server or printer memory bank or similar. This was hacked or otherwise accessed, and therefore the attacker accessed all the wallets at the same time and swept them all at once. Or perhaps OP also uploaded a copy of his paper wallet to his email or cloud storage, and again, a hack or rogue employee or similar then discovered his wallet at the same time as several other wallets, seed phrase back ups, or similar.