Our organization is facing a critical business-blocking situation. We have an unauthorized billing spike of ~$19,000 USD on our Google Cloud account.
The case has been open with Google Billing Support for over 2 months (Case ID:72347951), but we are stuck in a loop of agents asking for “5 to 7 more business days” to get a response from leadership.
Here are the undeniable technical facts of the incident that prove a platform-level issue:
API Key Name: Fitotrazabil..
API Key ID (UUID): `3b387470-b26b-4346-b03c-…
Creation Date: November 30, 2018, 11:04:21 AM GMT-3 (Nearly 8 years ago)
Original Intended Use: Maps API
Project Status: The project never reached production status.
Compromise Vector: There is absolutely no evidence of a compromised Service Account key or server breach.
This is a textbook case of the “Silent Privilege Escalation” architecture vulnerability. A legacy, unrestricted key from 2018—created long before Gemini existed—automatically and retroactively inherited full permissions to call the Generative Language API when the service became available in the project ecosystem.
Third-party attackers discovered this legacy key and flooded the Gemini API at machine speed, completely bypassing standard billing alert thresholds before we could react.
Given that this key was never used in production and inherited these massive AI billing capabilities without our explicit consent or quota configuration, we urgently request a Google Product Manager or Escalation Specialist to look into our Case ID and fast-track a full billing adjustment.
URGENT UPDATE: Our official Google Cloud Reseller (IPLAN) just notified us that they can no longer hold the invoice because Google already swept the $19k from their partner credit lines. They are now forcing us into a payment plan to cover the loss of a platform-level vulnerability.
Google is actively damaging its own reseller ecosystem and forcing local partners to collect unauthorized bills from clients for a 2018 non-production Maps key issue. We need a Cloud Billing Escalation Manager to step in immediately before this causes a severe legal and local financial escalation. Case ID: 72347951.
The technical evidence here is solid: a 2018 legacy key that never reached production inheriting Gemini scopes automatically. This definitely requires a manual adjustment from Google Cloud Escalation Managers. Giving this a like and bumping to get it to the front page.
This is a textbook case of why retroactive permission expansion without mandatory guardrails is dangerous. If a key was created in 2018 for Maps API, there is no logical reason it should automatically inherit full access to high-cost LLM endpoints like Gemini by default. The platform should have enforced a strict opt-in policy for legacy keys. Bumping this thread so the Cloud Billing leadership reviews the forense evidence provided.
Following this thread closely. As a fellow Google Cloud developer, seeing a company stuck in a support loop for 60 days over an automated bot attack on a non-production 2018 key is honestly terrifying. Google needs to fast-track these specific Gemini-related billing issues. $19,000 USD can ruin a mid-sized business. Hope the leadership team does the right thing here.
Thank you for understanding the business impact. A 60-day delay with constant ‘5 to 7 business days’ extensions is deeply damaging for a mid-sized operation. We trusted the ecosystem by leaving a non-production 2018 project untouched, never expecting a retroactive privilege expansion to open up a $19k liability.
Complete novice. Built an app in google ai studio. Due to there deployment feature being down we pushed it to git hub using their in built git hub feature. This was an internal app for my business. Never shared any information or code. I wouldn’t know how to.
Last week all within a day I get home to £8.5k taken from my account, £14.5k of Gemini api key usage racked up in a day!
I’ve opened a case with billing. I received a message from the case handler 48hours in saying it would take 3-5 working days. I have 3 days to go. I froze my card due to lack of funds. Google is actively still trying to take 5k more from my account every few hours which of course keep declining. I’ve had 6 attempts today.
I have issued a chargeback through my bank account which they have part awarded.
I wanted to share an update for anyone following this case or experiencing a similar issue.
On August 24, Google Cloud Support confirmed that the adjustment had been approved for USD 19,522.33 and that a request had been submitted to the Billing Modification team to process it.
As of September 10, however, the adjustment has still not been processed. Support has confirmed that there is currently no estimated completion date, although they have requested that the Billing Modification team expedite the process.
So, nearly three months since the original incident, the current status is:
USD 19,522.33 adjustment approved → still waiting for the Billing Modification team to process it.
I’ll update this thread again once the adjustment is finally reflected in the account.
Thanks, I appreciate it. It’s definitely been a long process, but at least the adjustment has now been approved. Hopefully sharing the full timeline here helps others dealing with the same issue.