That's not how security works. If someone gains unauthorized access to a system you own, you assume it's compromised and take it down, even if logs don't show

That's not how security works. If someone gains unauthorized access to a system you own, you assume it's compromised and take it down, even if logs don't show anything. If you leave a system unsecured on the internet, assume it has been compromised and take appropriate measures. In this case, it is more likely than not that this guy was not the first to discover the database. In the absence of proof, assume it has been compromised before.