> I took action as the primary on-call engineer to lock down the AWS account and prevent any actions by possible attackers. So he suspected an attack, but did

> I took action as the primary on-call engineer to lock down the AWS account and prevent any actions by possible attackers. So he suspected an attack, but did not contact his employer about it or other team members. No action taken to mitigate the attack or to identify what was going on. Just changed the AWS root account password and nothing else. Even assuming the very best intentions, I don’t think it unreasonable that Ruby Central found that a little bit suspicious.