[smarx007]

"a compromised token for a Heroku machine account" sounds more like a master key was stolen from a car dealer.

[mike_d]

That would imply a breach of AWS itself, which I do not believe to be the case.

[xena]

You get the wrong auth credentials in the right hands and everything goes to hell and back.