If you have any sort of footprint, it's pretty much expected you'd have protective monitoring so you can articulate what these pwned accounts have actually achi

If you have any sort of footprint, it's pretty much expected you'd have protective monitoring so you can articulate what these pwned accounts have actually achieved on your infrastructure. It doesn't really matter who runs your auth service, if the auth service getting pwned results in a reportable attack, you're in for a world of hurt. The next step is to articulate why this isn't your fault and that you did everything you reasonbly could have done to not get pwned. Do you have evidence to support you did your due dilligance on your provider?