We had basic security like MFA set up and we never shared keys, so we don't understand until this day how they managed to take over. The attack resembled a ver

We had basic security like MFA set up and we never shared keys, so we don't understand until this day how they managed to take over. The attack resembled a very aggressive, clever virus so the people behind it definitely had very advance knowledge of AWS. They could enable regions we had disabled and recreate roles that were deleted in a matter of minutes, again MFA on, no keys. AWS kept giving us conflicting instructions and refused to disable our account unless we stop the attack first. We have been customers of AWS since 2014. I believe during that time the Shared Responsibility Agreement did not exist, so AWS demanded we signed it now for them to even consider taking a look. That's when I reached out to the Attorney General of my state who sent a letter to AWS and got things moving. We were contacted by another team (two months later) in AWS that seemed much more knowledgeable and they gave us the scripts that eventually stopped the attack. Our case is not that rare, if you do some research you'll fine plenty of stories like ours.