Why is my account locked due to suspicious activity on new droplet?

We recently migrated from a different hosting provider to Digital Ocean in hopes of having better server stability since we would have several thousand customer orders on certain weeks, mainly during holiday events and sales. The migration was completed and our business which uses WordPress and WooCommerce was going smoothly for about a week.

However, DigitalOcean decides to lock the account due to “suspicious” activity and as a result had the entire server shut down, disrupting the entire business! We can’t even access the customer invoices anymore to process their orders, everything has come to a grinding halt due to this.

A ticket was automatically opened which stated:

“Because your recent account activity is atypical, we’d like to better understand your product needs. To help us in restoring access to the account, please respond to this email message with a description of the workload you’ve deployed on your Droplets and how you plan to use your account going forward.”

To re-iterate, this is a fresh droplet made about a week ago on a LAMP Stack, with WordPress and WooCommerce hosting a business operation where both customers and employees need to interact with in order to either buy products or process orders!

2-Factor Authentication is enabled to access the digital ocean account, only ports 80, 443, and 22 are open for inbound. Root login authentication is disabled, the only way to SSH into the server is via an SSH-Key and only two people in the world have access to that.

This is incredibly distressing, how fast is the response time, how often does this happen, what could possibly have caused this issue, and why did they have to shutdown the entire droplet on a business day? I have ZERO access to my data, so I can’t even pull the invoices out the MYSQL database to process them.

Can this issue also happen again? I can’t have this happening again when the busy holidays start.