Their cloud provider was in charge of backups.

You can try to offload responsibility from them, but every IT and DevOps person that has an inkling of competence knows you don't store your backups in the same place as your prod data.