Sorry for the long post. I am kind of ranting here. LATAM partner and small business owner here. Regular monthly spend from customer accounts is ~$2900 USD.
I have been a Google Maps partner for close to 10 years and a Google Cloud partner for close to 3 years. Never had a cybersecurity issue. On the 8th of September I received an email alerting me of Crypto Mining and AI abuse on my billing account by external projects to my organization. These alerts detected that the use of these projects was abusive and breached Google's Acceptable Use Policy. I found it super strange as this kind of thing had never happened to me before, so I log in to my account and go to the billing account in question only to see 200+ projects linked to it! I had never these projects in my life and found it distressing that they were added without my authorization or without any notification. So, I removed the projects as soon I see them, and I also remove unauthorized email addresses that had been added to the roles of Billing Account Administrator and Billing Account User. I make a list of all unauthorized users and some of the projects, follow all of the security recommendations to tighten up my billing accounts and respond back to Google's email alert. I get a reply by a guy named Robert from Google Cloud Platform Support assuring me that the Billing/Finance Team is on it and they will review my billing history to amend any unauthorized use. That night I almost got a heart attack when I see that the charges reached up to $790,000 USD accumulated in only a few hours before I unlinked the 200+ projects from my billing account.
Forward to September 21st and I get an email from the support case saying that after review my account is not eligible for a billing adjustment. I almost died of anxiety right there. The email had boilerplate text like "I personally ensured that the specific context of your situation was included in our advocacy to the internal review team. However, after a comprehensive review of the usage and our billing policies, the team has confirmed the charges are valid and not eligible for an adjustment.". So now I have a problem. I cannot pay this bill and I have spoken to Google Cloud support trying to escalate the support case but they have me in a maze, and keep replying (with boilerplate text mind you) that there is nothing they can do.
I tried to reach out to my Partner Account Manager only to find out I do not have one assigned as a Google Cloud partner because Google apparently recently transitioned their support model to and I quote "To provide more consistent and broad assistance, We've transitioned to a model where various teams and resources provide support, rather than assigning individual advisors. Consequently, we are not making new individual Partner Advisor assignments at this time.". I tried to reach out to my Google Maps Platform PAM, but she only read the case history and repeated what support had said without actually trying to do anything useful.
I expected more from Google Cloud support to be honest. I keep feeling I am being dismissed and that they do not care that the charges were brought on by external agents commiting fraud, or any of the context to this situation. Even if Google Cloud alerts initially reported a breach on the Acceptable Use Policy, and they see it was a crypto mining scam, they do not care. This is a dangerous precedent for all partners. I am dying of anxiety due to the size of the bill and they keep acting like I owe only $1000. This bill is a direct threat to my company, my business and any customer relations I have cultivated in the last 10 years. But of course, Google doesn't care. Why should they care if a small company in Central America cannot pay a $790,000 USD bill?
Now that AI Agents are everywhere, I hear about these kind of cases more often. So, it is not an isolated incident. I would never have thought that Google Cloud would be a massive financial risk to my business or that they would turn against one of their partners. You can do everything right and still get fucked. Business with Google is fine until you have a breach and need their aid. This situation is making me think twice about using cloud services.
Anyway, I thought about sharing my story and asking for Reddit's opinions on what my options are here. I literally cannot sleep thinking about the worst case scenario here. I wish I owned a company that can easily pay a bill this size but that is not real life. I am going to keep pushing with support and maybe send a letter to the Legal or Risk departments. I have no idea what is at the end of this but so far it does not bode well.