The company said its IT complied with industry standards and it had taken out insurance against cyber-attack.

Maybe it should have complied with the standards that include offsite backups, rather than just buying insurance and praying.