An attacker exploited an SSRF vulnerability to execute unauthorized commands on the server, retrieving sensitive metadata, including IAM role credentials. The commands were executed from an external IP address, potentially indicating a breach.