The real issue here is backups vs disaster recovery.
Backups can live on the same network. Backups are there for the day to day things that can go wrong. A server disk is corrupted, a user accidentally deletes a file, those kinds of things.
Disaster recovery is what happens when your primary platform is unavailable.
Your cloud provider getting taken down is a disaster recovery situation. The entire thing is unavailable. At this point you’re accepting data loss and starting to spin up in your disaster recovery location.
The fact they were hit by crypto is irrelevant. It could have been an earthquake, flooding, terrorist attack, or anything, but your primary data center was destroyed.
Backups are not meant for that scenario. What you’re looking for is disaster recovery.
What cloud backup solution are you using? A lot of them offer additional protection that would keep a history of your files. You can essentially say “once a week create a point in time recovery of all my files” and then you could recover your files from that point in time.
This usually costs extra, and it makes sense why. They’re essentially keeping extra copies of your data for you.
How that is configured allows you to determine your RPO, or recovery point objective.
https://www.imperva.com/learn/availability/recovery-point-objective-rpo/
So you can decide how much data you’re comfortable losing by determining how often those point in time recovery events happen.
Did that make sense?