Dev says Google warned him about account hijack – then charged him $11,000 anyway

1. Executive summary

Over June 7–8 2026, a solo developer's Google Cloud account incurred $11,089.77 in unauthorised charges driven by Gemini image-generation API calls after a firebase-adminsdk service account key was compromised. Google's Trust & Safety detected the abusive activity, suspended the account, and notified the developer — but Google Cloud billing has refused to refund the charges, invoking the Shared Responsibility Model without providing forensic evidence of how the key was exposed. No verified CVE reference data was resolved for this item; the incident is a cloud-account compromise via credential exposure, not a product vulnerability. The risk to EMEA financial services is operational and financial: compromised GCP service-account keys can generate unbounded billing with no effective GA spend-cap mechanism, and Google may hold the customer liable regardless of fraud determination.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	A compromised service-account key triggered account suspension and unauthorised API usage — an ICT-related incident requiring detection, containment, and response process.	Financial institutions running GCP workloads must have incident-management processes that cover cloud-credential compromise and unauthorised billing, including escalation paths with the CSP.
DORA Art. 18: classification of ICT-related incidents and cyber threats	Google classified the activity as "abusive activity consistent with hijacked resources" — a cyber threat classification by the CSP.	Institutions must map CSP threat classifications into their own incident severity taxonomy; a CSP "abusive activity" notification may constitute a major incident.
DORA Art. 28: ICT third-party risk — general principles	Google Cloud is an ICT third-party provider; the incident exposes risk in the provider's billing, credential, and spend-control controls.	Institutions must assess GCP's credential-exposure detection, spend-limit capabilities, and dispute-resolution transparency as part of third-party risk management.

3. Technical analysis & attack chain

Confirmed attack chain

Credential exposure. A firebase-adminsdk service account key stored on a single-access VM was compromised. The developer states he was the sole person with access to the VM and followed Google's recommended security practices. The exposure vector is unknown — Google has not provided any log path, forensic detail, or audit trail showing how or where the key was exposed.
Unauthorised API usage. The compromised key was used to invoke Gemini image-generation models over a 48-hour period (June 7–8 2026), accumulating $11,089.77 in charges. The developer states he has no workflow that generates AI images, confirming the usage was unauthorised.
CSP detection and suspension. Google Trust & Safety detected the abusive activity and suspended the account on June 7, citing "abusive activity consistent with hijacked resources." The notification advised the developer to report the compromise if a third party was responsible.
Containment by developer. The developer disabled the service account and revoked the compromised key, then completed Google's reinstatement process.
Billing dispute. Google Cloud billing refused to forgive the $11,089.77 charges despite the developer reporting the compromise as directed. Google has not responded to press enquiries about the denial or supporting evidence.

Technical specifics relevant to defenders

Compromised credential type: firebase-adminsdk service account key — a JSON-format key granting programmatic access to Firebase/GCP APIs. These keys are long-lived by default and carry broad IAM permissions scoped to the service account.
Abused service: Gemini image-generation models (Google's generative AI API family). The attacker used the key for high-volume API calls that generated billing charges.
Billing exposure: No generally available project-wide spend cap exists on Google Cloud. Budget Alerts do not automatically prevent usage or billing. A workaround to disable billing on budget alert can cause "resources might be irretrievably deleted." An experimental Gemini API spend cap introduced in March has a 10-minute delay and auto-upgrades tiers, raising caps as usage grows.
Forensic gap: Google has not provided the developer with any trace, log path, or forensic detail showing how the key was exposed. The developer reports sole access to the VM where the key resided.

Corroboration and confidence

The core facts (compromise, charges, suspension, refund denial) are single-sourced — reported solely by The Register based on the developer's account and documentation he provided. No independent corroboration is available.
Similar incidents are referenced: a Vietnam-based developer reported $82,000 in charges over 48 hours from a GCP API key compromise (February 2026), and a Reddit report cited $10,000+ in fraudulent charges (March 2026). These are cited as prior complaints, not independently verified by Adverse Trace.
No named threat actor is identified. No MITRE ATT&CK techniques or actor profiles are referenced. Attribution is unconfirmed — the source does not identify who compromised the key or how.
No CVE, CVSS score, or CISA-KEV entry applies to this incident. The verified reference data resolved to none for this item.

4. Mitigation & containment

P1 — Within 24 hours

Audit all GCP service-account keys. Run gcloud iam service-accounts keys list --sa=SA_EMAIL for every service account. Identify all firebase-adminsdk keys and any long-lived (keyType=USER_MANAGED) keys.
Revoke and rotate any keys not actively in use. Delete unused keys immediately: gcloud iam service-accounts keys delete KEY_ID --sa=SA_EMAIL.
Disable any service account that is not required. gcloud iam service-accounts disable SA_EMAIL.
Review IAM bindings for over-privileged service accounts. Remove roles not needed for the service account's function. firebase-adminsdk keys often carry broad permissions (Editor/Owner) inherited from Firebase project setup.
Check Cloud Billing for anomalous spend. Navigate to GCP Console → Billing → Reports. Filter by service (Gemini API / Vertex AI) and by the relevant project for June 7–8 2026.

P2 — Within 72 hours

Implement short-lived credentials. Replace long-lived service-account keys with Workload Identity Federation or short-lived OAuth 2.0 access tokens where possible. This eliminates the risk of a static JSON key being exfiltrated and reused.
Restrict API keys by referrer, IP, and API. In GCP Console → APIs & Services → Credentials, apply application restrictions (HTTP referrer, IP address) and API restrictions to limit blast radius.
Set up programmatic budget alerts with Pub/Sub notification. Create a budget with a Pub/Sub topic as notification channel. Deploy a Cloud Function triggered by that topic to disable the service account or project billing programmatically. Note: disabling billing may cause resource deletion — test in a non-production project first.
Enable Cloud Audit Logs for all data-access events. Ensure data_access log filters are enabled for the project to capture GetServiceAccountKey and API call events. Review logs in Cloud Logging: protoPayload.methodName="GetServiceAccountKey" or protoPayload.authenticationInfo.principalEmail="SA_EMAIL".

P3 — Within 7 days

Implement a project-level spending cap using Quotas. Set per-API per-day quota limits in GCP Console → APIs & Services → Quotas. For Gemini API, set aiplatform.googleapis.com/generate_content_requests_per_minute_per_project and per-day equivalents to a ceiling aligned to expected usage.
Store service-account keys in a secrets manager. If static keys are unavoidable, store them in Google Secret Manager or an external HSM/KMS and access them at runtime — never persist them on disk or in environment variables on a VM.
Review VM access logs. In Cloud Logging, query protoPayload.methodName="compute.instances.getSerialPortOutput" and protoPayload.methodName="compute.instances.use" for the VM where the key resided. Check OS Login, SSH key metadata, and serial-port logs for unauthorised access.
Document the incident and dispute. Preserve all correspondence with Google Cloud support, suspension notifications, and billing records. If the institution is a regulated entity, record this as an ICT-related incident per DORA Art. 17.

5. Indicators of compromise

No indicators of compromise available in the source material. The source does not provide IP addresses, domains, file hashes, user agents, or other atomic IOCs. The compromised credential identifier (firebase-adminsdk service account key) is a credential type, not a specific IOC, and no specific key ID, email, or project ID is disclosed.

6. Detection

The source provides no specific IOCs (IPs, domains, hashes, user agents, or distinctive strings). However, the behavioural pattern — a firebase-adminsdk service account key used for Gemini image-generation API calls — is distinctive and can be detected via Cloud Audit Logs.

title: Detect firebase-adminsdk Service Account Key Used for Gemini API Calls
id: 0d1e2f3a-4b5c-6d7e-8f9a-0b1c-2d3e-4f5a
status: experimental
description: >
  Detects a firebase-adminsdk service account invoking Gemini image-generation
  or Vertex AI APIs, which may indicate a compromised key being used for
  unauthorised API consumption. Based on the attack pattern described in
  AT-2026-07-03-236.
references:

  - https://www.theregister.com/cyber-crime/2026/07/03/dev-says-google-warned-him-about-account-hijack-then-charged-him-11000-anyway/5266234
author: Adverse Trace
date: 2026/07/03
logsource:
  product: gcp
  service: cloud_audit_logs
detection:
  selection:
    protoPayload.authenticationInfo.principalEmail|contains: "firebase-adminsdk"
    protoPayload.serviceName|contains:

      - "aiplatform.googleapis.com"
      - "generativelanguage.googleapis.com"
    protoPayload.methodName|contains:

      - "GenerateContent"
      - "Predict"
      - "StreamGenerateContent"
  condition: selection
falsepositives:

  - Legitimate use of a firebase-adminsdk service account for Gemini API calls
    (unusual — Firebase service accounts are not typically used for AI inference)
level: high

7. Sources

The Register, "Dev says Google warned him about account hijack – then charged him $11,000 anyway," https://www.theregister.com/cyber-crime/2026/07/03/dev-says-google-warned-him-about-account-hijack-then-charged-him-11000-anyway/5266234, published 2026-07-02T23:08:16+00:00

8. Adverse Trace position

Severity: MEDIUM. No CVE or CVSS score applies — this is a cloud-credential compromise and billing-dispute issue, not a product vulnerability. The verified reference data resolved to none for this item, and we do not re-assess. The incident is single-sourced (The Register, based on the developer's account and documentation); verify before enforcement. Attribution is unconfirmed — no threat actor is named, and the compromise vector is unknown. For EMEA financial services running GCP workloads, the practical risk is twofold: (1) a compromised long-lived service-account key can generate unbounded billing with no effective GA spend cap, and (2) Google may hold the customer financially liable without demonstrating customer negligence or providing forensic evidence of the exposure vector. Adverse Trace recommends clients audit all firebase-adminsdk and other long-lived service-account keys, migrate to short-lived credentials where possible, implement programmatic billing-disable via Pub/Sub + Cloud Function, and record this incident pattern in their DORA Art. 17 ICT-related incident management process. We will continue to monitor for corroborating reports and any Google response.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.