"How do I recover if I need to rebuild my entire system from scratch?" is a basic business continuity exercise. I know that most startups don't bother with it,

"How do I recover if I need to rebuild my entire system from scratch?" is a basic business continuity exercise. I know that most startups don't bother with it, but stories like this are exactly why it matters. You need to plan ahead, have backups of your data under your own control, with documentation of a DR plan to completely rebuild and recover should you, for any reason, lose every single vendor you work with today. If you don't have that, then you are not truly a stable company. And while you might have delegated responsibility of server security to a vendor, that does not absolve you of overall accountability for what happens to your business.