I need to share this because I've seen similar cases here before — and I think more people need to know this can happen to them. What happened I'm a founder of a small tech startup. We had been using Google Cloud Platform for some internal projects — nothing heavy, usage was close to zero since we were in the process of migrating away from GCP entirely. A few days ago, I logged into the billing dashboard and found charges of approximately $$19,000 USD — generated in a short period, with no legitimate usage on our end whatsoever. After investigating, we confirmed that an API key associated with the Gemini API (Generative Language API) had been compromised. Unknown actors used automated bots to fire a massive volume of unauthorized requests through our key, racking up the charges while we had no idea it was happening. We acted immediately: Disabled the Gemini API Revoked and deleted the compromised key Shut down and deleted all affected projects And yet — the charges are still growing. Every day.…