Not trying to be snarky, but the biggest lesson here seems to be "don't operate without off-host backups". Cheap VPS providers don't typically offer that sort of thing as a standard feature. Even when they do, the backups would be on the same infrastructure, and easily wiped from the same (compromised) console.

You could have just as easily lost all the data in an accidental way, with no malice or 3rd party involved.

That said, I do empathize, and it's disappointing that a major player like namecheap would be so easily socially engineered.