Analysis of the May 28 breach shows tight scope but zero transparency. Here’s what MSPs must do to validate their defenses.