I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet
However, the instance has a relatively strong password (12 characters, symbols, numbers, and lower case and capital letters)
Is there public record of a database like this having been hacked?
Now production queries made to it are done through SSL but is not a requirement, and I suppose this would be much harder but is there public record of a database like this having been hacked? (this time considering SSL)