[smoyer]

First, I understand your technical arguments above (but IANAL.) Find a technical lawyer who understands that your logs and/or subscribers list sets a hard limit to the damage you might have caused. I'm a bit curious about why you're being charged at all if the S3 bucket was publicly available - there are easy ways for the company to secure their bucket if they choose (one example - https://www.msp360.com/resources/blog/how-to-prevent-hotlink...).

You're headline states that you didn't do it but your descriptions admits you did, but maybe not all of it. You need to be completely honest with this. The journalist in Missouri who identified teachers SSNs on the state's web-site was in a similar situation and, while he's ultimately not going to be charged, his legal fees are hefty.

[lalahazel]

My understanding is they admitted they did it but not to the extent of loss this company is claiming they did-- thus would legally make the case more severe with sentencing...