Hacker News Reader

In my opinion, it is negligence to an extent that OP should not have to pay for this, and he should find a new VPS provider.

Why? He failed to secure his server. Why is that the fault of the VPS Provider?