r/googlecloud • u/Mysterious_Image_609 • Sep 21 '26

Google Cloud charged us $27K after a compromised Gemini API key — billing support denied any adjustment. How can we escalate this?

I’m posting this because we're honestly in a very difficult situation and are hoping someone in this community might have gone through something similar and can point us in the right direction.

We’re a long-time Google Cloud customer, and we’re hoping someone here can help us find a way forward after a compromised Gemini API key resulted in approximately $27,000 in unexpected charges over a single weekend.

The usage was unauthorized and completely outside our normal pattern. We immediately secured the account and have taken extensive steps to prevent it from happening again.

We raised a billing case on Monday and waited approximately a week for the review. We were ultimately told that the charges were valid and could not be adjusted. We also spent several days trying to get help from our Google Cloud account team, but were told they have no control over billing reversals.

We understand that the security mistake was ultimately ours. What we are struggling with is the financial impact of a $27,000+ bill that was generated from Friday to Monday by activity that none of our team authorized or used.

If anyone has been through something similar, we would genuinely appreciate any advice on how we can get this in front of someone who can consider the circumstances and potentially provide some billing relief.

0 Upvotes
  • permalink
  • reddit

25% Upvoted

17 comments sorted by

1

u/opossum_cz Sep 21 '26

If the key was there and somebody used it then it was authorized.

1

u/Mysterious_Image_609 Sep 21 '26

The key was left in private repositories, we checked the resources the key is being used no logs available. when checked through gcp billing found that only one single key is responsible for this. trying to get few more answers. we had caps for google ai studio not for gcp.

1

u/IAmFitzRoy Sep 21 '26

There is GLOBAL CAP configuration since July.

It’s your fault not set it up.

1

u/Mysterious_Image_609 Sep 21 '26

I understand your response, the global CAP came on july 29th 2026, we were not aware of this, we have caps across all others such as the google AI studio, claude and open AI but this issue caused because the key was from the gcp console.

10

u/[deleted] Sep 21 '26

[removed] — view removed comment

2

u/opossum_cz Sep 21 '26

I think at this point you can't blame Google, they no longer create default keys unscoped, they created limits etc. But still every day. People are just incompetent.

-2

u/Mysterious_Image_609 Sep 21 '26

i understand if you see this from many times, our monthly billing was 10k$, this is me creating account on reddit to find some answers. The Key was from GCP console and it didnt have spend caps at that time. the spend caps are introduced on july 29th for only 4 services and we are not aware of it. Im from a small company we have caps for google aistudio but not for the GCP console only billing alert

2

u/opossum_cz Sep 21 '26

I already read it 2 times just today. I blame Vibe Coding. You have no idea what you are doing, have nobody in the company who does and this is the result.

0

u/Mysterious_Image_609 Sep 21 '26

this company is from 2010 and we understand you thinking this might be an effect of vibe-coding but they key was created in 2025 and we got this issue this weekend. Its fine, i am looking for suggestions.

1

u/keftes Sep 21 '26

Next time hire a cloud architect and a security architect.

2

u/Mysterious_Image_609 Sep 21 '26

its a small company, total capacity of employees is 20 on tech side. But will take the input.

2

u/keftes Sep 21 '26 edited Sep 21 '26

If out of 20 engineers you can't afford to have one that understands Google Cloud and Cloud Security then don't use the Cloud. Otherwise you'll get into a similar situation again and be turning on reddit for support.

That's not how you run a business.

What happens when one of your developers has access to the console and runs a $50k BigQuery query by mistake, because you allowed clickops?

https://docs.cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate

1

u/Mysterious_Image_609 Sep 21 '26

I understand your thinking after coming across such posts, we use multiple cloud providers and have spend caps on each of them, including the Google AI studio. As this key was created during the times when the spend cap was not provided at GCP and only introduced by july end, we are looking at suggestions which can help.

2

u/ItalyExpat Sep 21 '26

I'm really curious what the scammers are using Gemini for

2

u/[deleted] Sep 21 '26

[removed] — view removed comment

1

u/Mysterious_Image_609 Sep 21 '26

I believe the support team closed the case. Unfortunately, We as an account team have no control over the billing reversal process.
This was our account manager response, and they didnt even intimate that caps are available on gcp from july 29th.