After reading the affidavit it was a former AWS employee. The accused worked there from 2015-2016 and it’s not immediately clear that it was a misconfigured S3

After reading the affidavit it was a former AWS employee. The accused worked there from 2015-2016 and it’s not immediately clear that it was a misconfigured S3 bucket. There’s a particular IAM role she used to execute API commands (ListBuckets, etc..). The buckets contained credit card applications and other data including DOB and SSN. She gloated about it on Slack and said she was using a VPN and Tor. The affidavit is a good read. Linked elsewhere in this thread.