Analytics bucket is publicly readable

A researcher reports that an S3 bucket holding nightly analytics exports (CSV dumps that include hashed-but-reversible-where-weak PII and internal metrics) is publicly listable and readable, s3:ListBucket and GetObject granted to *. Access logs show steady anonymous GET traffic from varied IPs over the past ~9 days, downloading most objects. A recent IaC change to 'make the bucket accessible to the BI tool' added a broad bucket policy instead of a scoped one. No alarm fired because nothing was 'breached', it was just open. How do you triage what's exposed, contain it, and prevent the class of mistake?