How is this even possible? Do you host this on VPS?

Buy a dedicated server with access to KVM via iDrac or ILO then do system installation with full disk encryption. Change all default passwords.
There's literally 0 ways how you can get access to server content this way, assuming all applications running on server and your own administrative credentials are save.

Only thing attacker can do is try to social enginner hosting company to redirect IP addresses to different machines.