AWS Subdomain Takeover even with the DNS entry pointing to a cloudfront distribution

Hello. I'm aware that the subdomain takeover happens when you have an orphan entry in the DNS that can be taken over by a hacker to display malicious content, however, my current setup is as follows:

• I have a bucket containing a static webpage called app.mysite.com
• I have a CloudFront distribution with two Alternate domain names: app.mysite.com and www.app.mysite.com
• I then have two DNS entries type A that are aliases to this Cloudfront distribution: app.mysite.com and www.app.myapp.com

Recently I got contacted by a hacker that has taken over www.app.mysite.com and he did it by creating a bucket named www.app.mysite.com. How come this vulnerability is even possible if my DNS entry is not even pointing directly to this bucket? both app. and www.app. are pointing to the Cloudfront distribution.

*** Recent Update *** Also, upon further investigation and looking at the hacker report a new relevant information was found: at the window of the attack, the hacker reported that the www.app.mysite.com was throwing 404, meaning that for some reason, the cloudfront distribution lost the connection with the bucket at the time of the attack. That rises that the rootcause wasn't the initial setup, which was rightly protecting from such exploit, but the fact that the Cloudfront removed the connection of that subdomain to our bucket, causing it to be vulnerable for the take over. Has anyone seen a known issue where Cloudfront simply stops pointing to your bucket and in case, how can this outage be prevented?