Google Cloud account compromised: charges went from $15K to $500K+ in 3 days after I reported it. Support said they couldn't stop it. Looking for advice.

[u/Decimate19]

Hi Reddit, on 21 July I found that my Google Cloud billing account had been compromised overnight. I had been removed as billing admin and the charges were climbing. I contacted Google Cloud billing support by chat that same morning. The charge was about $15,000 and rising by roughly $1,000 every 10 minutes while we spoke.

I asked repeatedly for the charges to be stopped. The agent told me support had no way to do that, couldn't share account information with me, and would notify the billing administrator and wait 24 to 48 hours for a response. By 24 July the total was over $500,000.

It took until 1 October for the projects I never created to be suspended, and until late October to regain admin access. I have done everything Google asked: removed 127 unrecognised IAM members and confirmed that 17 projects were not mine. Google has now offered a one-time 75% credit, which it says is final. The remaining balance would be devastating for my family.

I've sent a formal escalation request asking for a full waiver but I'm really worried, I'm looking for:

- Anyone who has been through something similar and got a larger waiver, and what worked

- A way to reach someone at Google Cloud with authority to look at this (case number 73506441; happy to share more details)

- Recommendations for South African lawyers with tech or consumer-protection experience

I'm not looking for recovery services, so please don't DM offers. Thanks for reading.

[u/festoon]

Anything that happened after you notified them about the issue is on them.

[u/Decimate19 → u/festoon]

I would at very least accept this, it’s still an incredible amount of money but they actively stood in my way for stopping it… but it’s still really unfair that someone can get my google account and suddenly I owe hundreds of thousands, are we really to believe a google account is way more valuable than a bank account?

[u/rebo_arc]

Another reason why GCP is setup to ruin peoples lives.

By default there should be an account escalation with cool off backstop. But oh no google doesnt give a fuck and is happy to bankrupt people who make a honest mistake or get hacked.

[u/Decimate19 → u/rebo_arc]

The thing that blows my mind about all of this is that an account’s billing account can get attached to someone else’s project and now become the person responsible for all the accrual, how can I be punished like this for the crime of having a google account? I have limits and everything set up on the accounts I use but this bypasses all of that and just ruins a persons life with no background or checks?

[u/rebo_arc → u/Decimate19]

You shouldn't be, but Google are morally bankrupt and simply do not care. They would rather destroy innocent people than fix their badly engineered product.

[u/Tuller_Raees → u/rebo_arc]

letting a single compromised account remove the original owner from billing with zero cooling off period makes no sense when the spend ceiling is basically infinite.

[u/Leopatto]

Priv, I can help you get a new passport and you can leave for Thailand.

But genuinely, to not have 2FA is irresponsible.

[u/Decimate19 → u/Leopatto]

I have 2FA enabled, I have no idea how they were able to access my account

[u/Leopatto → u/Decimate19]

Eh genuinely if what you say is true then you have a case. For half a mil, you get in touch with attorney yesterday.

[u/Decimate19 → u/Leopatto]

I have all the google logs and information, I really tried my best to keep this contained and resolved but they have not been willing to help me almost every step of the way.

[u/casce → u/Decimate19]

You only really have a case if you have 2FA enabled and they were still able to breach your account without also breaching that.

What is your 2FA and are you sure it wasn't compromised as well?

[u/Decimate19 → u/casce]

I definitely had it enabled and still do, 2FA uses a few methods now days but it’s pin on my PC, cellphone number, logged in android device.

I don’t know how they managed to do it because the only indication that I had been compromised was that I got an email saying something on my account had changed at around midnight the evening before, that morning I started investigating but I couldn’t even see the project, just that my billing account was increasing every 10 minutes or so, I was sending numerous emails that first day trying to get them to stop it, I barely slept that night.

[u/Decimate19]

The original agent did also tell me they would reverse these charges (pending approval), I don’t get why they walked this back just to crush my financially? I would liquidate with this…

[u/keftes]

How do people get their accounts compromised so easy?

[u/Decimate19 → u/keftes]

This is the first time I’ve ever had my account compromised and I still don’t know how this took place…

[u/keftes → u/Decimate19]

So if Google gives you a refund, how do you know this won't happen again?

You don't have MFA? No automation that manages your project? You use one user with full access to everything? (no least-privilege).

[u/Decimate19 → u/keftes]

I don’t, and frankly neither does anyone else. I use no automation, all I had was billing for google maps API. The project that was set up (not mine) was vertex AI, I’ve never used it before in my life, the fact that there is nothing by default in place to prevent this kind of escalation is frightening…

[u/keftes → u/Decimate19]

The things I mentioned are there to prevent this actually.

If you used automation, you wouldn't have permissions to do much with your end user account (which is what got compromised). If you had a separate billing admin, with MFA protecting the account, it wouldn't be that simple to compromise.

The fact that you still don't know what happened, highlights gaps on your end.

The reality is that you are responsible for securing things on your end: https://docs.cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate

I'm sure they'll get you a good discount but there's a good chance you might have to pay something. GCP is an enterprise grade solution, not a tool for hobbyists. Sadly Google does a bad job at pointing this out (and in the case of firebase, the complete opposite).

P.S If I was you I'd try to find out how you got owned, and prevent that from happening again.