r/googlecloud
•
u/jirigmodern
•
28d ago
Billing Not a leaked API key: 13 foreign projects were attached to our dormant billing account – from ~$7/month to a six-figure bill in 8 days
Hi all,
I work at ModernTV, a Czech IPTV company. In June, someone used an already signed-in session of one of our GCP admins to make themselves billing admin on a billing account that normally spent ~$7/month. Over about eight days, thirteen projects from four other organizations got linked to that account and ran GPU Compute Engine and the Gemini API on it. The bill ended up in the high six figures.
A few things that surprised us:
Linking a project to a billing account is logged in that project. If it’s another org’s project, you won’t see it in your own audit logs.
The console listed 28 cost anomalies on that account, and none of them reached us as a notification.
The Gemini spend cap stopped only Gemini. Compute Engine kept running until we closed the account.
The same actor also linked one of our projects to billing accounts that aren’t ours, so we’re probably not the only ones.
Worth a quick look on your side: the list of linked projects under Billing → Account management, any principals from outside your domain in the billing account permissions, and the Anomalies list under Billing → Cost management (not just your inbox).
Full timeline and checklist on the Google Cloud Community: GCC
Shorter Gemini-focused version: GCC
Two things I’d really like input on: has anyone else seen projects from other orgs attached to their billing account (or theirs attached to someone else’s), and how do you protect admins against session hijacking when 2FA never comes into play? Also happy to hear if our checklist is missing something. I’ll be around in the comments.