The irony -- so not only was their system hacked ("hosted onsite"), but then it was also burned down onsite with no backups.

In other words.. there was no point in the extra security of being onsite AND the risks of being onsite single failure point destroyed any evidence.

Pretty much what I'd expect tbh, but no remote backup is insane.