Damn, sorry OP. I think it's terrible that they won't tell you why they suspect you of phishing and won't let you access the backups. I hope your legal action s

Damn, sorry OP. I think it's terrible that they won't tell you why they suspect you of phishing and won't let you access the backups. I hope your legal action succeeds and you get your backups back. That said, I think it should also be mentioned that "managed hosting" doesn't mean you don't have to worry about anything. On the backup side it's always a good idea to have one or two offsite backups not at your primary host, if only for disaster recovery. And on the security side, it's usually a shared responsibility where they might manage some of the network layers and help prevent and mitigate DDOS and such, but there's no managed hosting company that can fully secure your application stack for you. They'd have to audit every line of code in every dependency for every customer, which is impossible. That's usually your own team's responsibility. Still, that's not to say what they did was right, and they should be working with you to identify and fix the issues instead acting like you are the enemy :( Thank you for the warning. What a terrible experience!