My business has not (yet?) been compromised, but I did accidentally send my S3 bill into the stratosphere in the past 12-18 months by miscalculating API charges for some intra-AWS changes I was making with lifecycle management and bucket-to-bucket moves.
I wrote to support asking for a refund and explained my calculations. I pointed out where I had made the mistake, and asked for some relief on the bill. Honesty went a long way in that case, and they gave me a credit on the bill equal to about 70% of the total S3 spend. So they ate 70% of my mistake. That was more than fair enough; it was my error.
The amounts weren’t huge. They could have eaten the entire amount and it wouldn’t have even been a rounding error on their books, but I didn’t ask and I didn’t want to expect that.