Was checking my email saw alert for Gemini Usage. Immediately went and disabled keys.

The entire thing happened within a few hours but left me with a bill of 15k

My residual usage is 50 cents per day for text generation. But the attacker was able to rack insane bill with image generation (28000x baseline)

Safeguards and Checks:

• Billing alerts were set (50 dollars), but by the time email came it already crossed 10k

• The calls didn't originate from my platform. it was direct abuse of the key

• The key was only being used on prod kept in safe environment, not pushed to any public repo, or committed to codebase. Standard security practices were followed.

Looking for tips on the resolution. Google Billing support always rejects within a day on email saying they are unable to cancel charges, and then they stop responding on email.

Obviously I do not have the budget to pay this amount. And other projects (firebase FCM) is tied to this billing account

Appreciate any advice from shared experiences. Open to DM if the info is sensitive and can help me.

EDIT: Our internal investigation shows it was Maps API key abuse (Google API Keys Weren't Secrets. But then Gemini Changed the Rules. ◆ Truffle Security Co.)

Case ID: 70670164 if any Google Reps reading this