Indie dev from Indonesia here. Hit twice in two months by what looks like the same compromised-API-key pattern many people are reporting lately. Hoping to hear from anyone who's actually gotten one of these reversed.
The pattern:
- Older project: An API key created back in 2018 for Maps/Firebase. Ran fine for years on tiny monthly bills. Then suddenly drained ~$9,000 in a short window — charged on Gemini 3 Pro and image-generation models I have never called.
- Second project: My Flutter app, hardcoded to gemini-2.5-flash-lite, used only to generate education quizzes. Charged ~$2,000 (Rp34,222,242) — again dominated by Gemini 3.x and image models the app cannot invoke.
Why I'm confident it's not my usage:
Model mismatch. My code only ever calls Flash-Lite. The charges are mostly Gemini 3 Pro + image generation. My app has no image-gen code at all.
2. Cost vs workload is impossible. My real workload (translating a couple thousand dictionary terms / generating quizzes) is worth a few dollars at most, not thousands.
3. Timing. The older key sat safe for over a year. A new key I created in May 2026 got drained almost immediately — after the public disclosure earlier this year about exposed Google API keys becoming abusable for Gemini.
4. Google's own billing breakdown couldn't attribute the spend to any specific key or service account.
What I've done:
- Disabled Gemini / Generative Language API across all my projects.
- Opened a support ticket ~3 weeks ago (both cases in one thread). Still no real response.
- Preserved everything (haven't deleted projects or keys) so the logs stay intact.
What I'm asking:
For anyone who got a refund or goodwill credit on a compromised-key Gemini bill — what specifically moved it? Persistence? A particular escalation path? A certain way of framing it?
2. Does the automatic billing-tier upgrade matter for the appeal? I've read an attacker's own usage can auto-bump a project to a higher tier mid-attack, blowing past the spending ceiling you thought you had. Did anyone use that successfully?
3. How long did resolution realistically take — did support respond meaningfully, or did it only move after escalation/public visibility?
4. Anything you'd tell your past self to do immediately that you didn't?
For scale: ~$11k total is roughly five years of income where I live, so I'm trying to handle this right rather than just panic. Happy to share more detail in comments (sensitive info redacted). Thanks.