Not a law firm.We connect people affected by data breaches with independent attorneys.

Incident information

Charged for Unauthorized Gemini API Usage on a Compromised Key? Learn About Your Options

Information about this incident and a simple way to see if you may qualify to be connected with independent attorneys.

What happened

Google Cloud and Gemini API developers have reported large unauthorized charges after legacy or compromised API keys were exploited by attackers. Some users report charges of roughly $19,500 to $27,000 over a single weekend.

Users report that billing support denied adjustments or refunds, citing "valid usage processed in accordance with standard platform functionality" and the shared-responsibility model, including in cases where keys predated Gemini APIs, spend caps did not stop the charges, or the suspicious activity had been flagged.

Reported unauthorized usage on compromised or legacy keys
Reported denials of refund or credit requests
Reported charges continuing despite key rotation and alerts

No class action had been filed on this issue as of the original report.

Possible remedies

Possible remedies, if any, depend on the facts of your situation and applicable law and may include, for example, refunds of unauthorized charges. No outcome or payment is guaranteed.

Official source

Read the original public notice or report about this incident (opens in a new tab):

https://discuss.ai.google.dev/t/google-cloud-charged-us-27k-after-a-compromised-gemini-api-key-billing-support-denied-any-adjustment-how-can-we-escalate-this/184142

See if you may qualify

Were you charged for unauthorized Google Cloud or Gemini API usage? See if you may qualify to connect with an independent attorney.

First nameLast nameEmail addressPhone (optional)State of residenceBriefly describe how you were affected (optional)

Optional. Please do not include Social Security numbers, dates of birth, account numbers, or medical details.

I agree to the Terms and Privacy Policy and consent to DataBreachRelief.com sharing my information with one or more independent law firms, who may contact me about my potential claim by email or phone. I understand this does not create an attorney-client relationship.Optional: I agree to receive calls/texts, including automated, from DataBreachRelief.com and partner law firms at the number provided. Consent is not a condition of service. Msg & data rates may apply. Reply STOP to opt out.

Thank you. Your information has been received. If a participating law firm is interested in your situation, they may contact you.

Sorry, something went wrong and your information was not sent. Please try again.

DataBreachRelief.com is not a law firm and does not provide legal advice. We are an independent information and referral service. Information you submit may be shared with one or more independent law firms that may contact you about your potential claim. Submitting information does not create an attorney-client relationship. Listing an incident does not mean a lawsuit has been filed, and no outcome is guaranteed. Attorneys who receive referrals may pay us a fee for advertising or lead services.