> If the data was never secured in the first place can you call it a breach?
Yes. It's a "breach" even if just a security researcher found it. It's sometimes even a breach even if only an employee found it (depending on the specific role of the employee and controls on the data).
> They found this, great, was there any indication it was accessed directly before that? Is that something that can even be investigated?
You can be found "not guilty" by a jury, but that doesn't mean you are innocent. Sometimes there just isn't enough evidence of the crime.
We should care more about whether a crime happened than we care about whether we can prove the crime. In cybersecurity, not having enough logging should be something along the line of negligence.
> Did you prevent 845 GB of data being found by a black hat or did you find that data because of a black hat?
I've seen it both ways. Some employees are diligent and go out of their way to investigate proactively. Sometimes an employee only investigates if there is a sufficiently suspicious finding. I've seen instances where the only hint that a user breached a database was a SQL query error that got logged in an application such that the app as designed couldn't generate that query.