I wonder what the RBAC permission history is for the bucket. If that's obtainable, the answer should be obvious.. if it was open from the beginning.

Payment data, including card data, was obtained as well. This would not be held by the crowdfunding platform, but by the payment processor only, that are subject to quite a few rules and annual audits.

Definitely a hack.

Besides, opening unlocked doors can still get you charged with break and entry, or in this case, unauthorized access.

Didn't he just query a publicly accessibly s3 bucket? What law did he break exactly?

If you forget to lock the door to your house, am I allowed to go inside and start taking pictures of everything?

More fair analogy would be leaving your stuff outside, than inside but under unlocked door.

So if you use a version of Windows that is not updated and has a backdoor, is that fair game for "hackers" as well? It is "publicly accessible" for all intents and purposes. When does it become fair game? In the first day? 100th day? after 2 years?

Even if the info was easily accessible, it seems to me that distributing PII should be against some laws.

I believe so, and that is a fair question. Also, I haven't seen proof that he was the only one. Did you watch the videos he posted? If so, what do you think about the situation?

The whole thing is an awful mess.

Any proof? Did Amazon confirm this? I know there was a file there that said the bucket was public, but that could have been added by the hackers as misdirection to sow doubt.