In reply to Peter Knight.

Hi Peter, it's true that both managed and unmanaged hosting can have the same sorts of problems. The difference is what happens when those problems arise.

Using this incident as the example, if you were in this position as your own sysadmin with your own VPS, you would need to hire and manage an external security firm (which we did, but we have an internal security team who could do that), you would need a lawyer to work with the authorities (which we did, but we have in-house council), you would need to perform diligence on an investigation and any remediation, and more things which sadly I'm not at liberty to discuss here.

In the case of managed hosting, we did all of that on behalf of our customers. That is a substantial service.

Of course, it's small consolation that it's "a service," considering that even better would be to not have the incident at all! So it's not like we're patting ourselves on the back -- it's simply doing the right thing.

But, to your point, it can (and does) happen to anyone, and only in a managed environment will the vendor take care of that for you.