One of my instances was deleted by someone using some credentials I've never set before?
I checked my audit logs and it seems this bot is running on IP 158.101.208.253, he had been doing the same request for MONTHS trying to find an instance ID it seems. And when it finally found one, it terminated the instance. It seems to have started on 20th of jan 2022.
I seriously have no idea how this even happened. I've never set up an API key, nor share password (previous password was practically uncrackable).
But of course, since I'm a free user, this will probably fall on deaf ears, so I don't have my hopes up of ever finding out how some other Oracle Cloud user can just use an API key (I've never set one) to do this.
Very fun.