Highly likely to be coincidence. Typically an exposed access key. Exposed password for non-MFA protected console access happens but is less common.