API Aidan

Google Cloud Customer Faces $18,000 Bill Due to Exposed API Key

Published April 24, 2026

Share this card

A Google Cloud user was hit with an $18,000 invoice after a forgotten public API key led to unauthorized 60,000+ requests, dwarfing their $7 budget.

The Real Story

A Google Cloud client encountered a shocking $18,000 charge, far exceeding their intended $7 budget, due to a forgotten public API key in their project. This oversight allowed an attacker to make over 60,000 unauthorized requests. Despite having a $1,400 spending cap in place, the system's limitations were bypassed, leaving the user with a massive bill after the spending cap was overridden by the sheer volume of queries.

Read the original article →