Another Step after losing keys

I would also recommend going through the list of IAM users to make sure you can account for them. If the compromised security keys gave access to IAM and create users, the bad actor could have possibly created another inconspicuous account for themselves.