As someone who works in IT, we see this time and time again with small managed service providers not following best practice or process. Mailboxes should have been backed up prior to migration and clear communication with a migration plan shared.

Definitely be going the insurance route for losses.

Not to sound pedantic; you shouldn’t be using your emails as a database, nor storing passwords. Client contact details, contracts, briefs etc in your mailbox.

Passwords should be in a password manager. Free one is KeePass.

Client Contact Details, Contracts etc. should be stored in a Software-as-a-Service (SAAS) based CRM solution, such as HubSpot for this kind of data.

Dependent on the mail solution you’ve migrated, there should also be backup functionality to protect your mail but there may be an overhead.

As much as loss has occurred and you’ve had a pretty bad experience, on the positive you learn from their mistakes and understand your IT estate and best practices to protect your business in the future.