As I suggested I doubt they sent them a quick mail :) I would have hoped they provided detail and logs to show what happened. We're not talking about instantly

As I suggested I doubt they sent them a quick mail :) I would have hoped they provided detail and logs to show what happened. We're not talking about instantly recognizable traffic here; this was likely HTTPS traffic. It's trivial enough to spot if you review the logs and the information available. Anyone with an ounce of security knowledge would spot it very quickly. Should the hosting company have circumvented your access controls and looked into your VM? They do this anyway; as root on the dedicated machine they have access to your VM anyway :) There are exceptions for illegal behaviour This is illegal behaviour isn't it :)