You judge without knowing enough details to do so. For all we know, the contract with the data center may have included regular backups, including off-site back

You judge without knowing enough details to do so. For all we know, the contract with the data center may have included regular backups, including off-site backups. In such a case, as a company, you've done everything you could and should have and the data center is entirely to blame, if the employee managed to destroy the backups as well.