Hello Community Managers,
I am posting on behalf of the project owner and urgently asking for guidance or manual escalation.
Our GCP project appears to have been affected by credential exposure, hijacked resources, or unauthorized usage.
Affected project:
- Project name: my digital twin
- Project ID: my-digital-twin-5561f
- Appeal / Ticket Reference ID: T4RJ5FJRTGPBQAPKNBAOMHF6R4
The project was first suspended on May 9, 2026 due to activity related to hijacked resources / malicious activity. We submitted an appeal and explained that a Firebase/API key may have been unintentionally exposed during development, and that remediation steps had been taken.
Google restored the project on May 11, 2026 and instructed us to resolve the remaining compliance issues.
However, around June 4, 2026, the project appears to have been suspended again after subsequent legitimate use/testing. Since then, we have been unable to access the project normally through the Google Cloud Console. We are redirected to the appeal page, so we cannot access the necessary IAM, Credentials, Service Accounts, Compute, Logging, or Billing pages to complete remediation.
We submitted follow-up appeals on June 6 and June 16, 2026, but we only received automated “Appeal Received” confirmations under the same Ticket Reference ID. We have not received a substantive human response that allows us to resolve the suspension.
Meanwhile, Google Cloud Platform & APIs has charged approximately 290,557 KRW:
- June 4, 2026: KRW 100,000
- July 1, 2026: KRW 190,557
Our main issue is that the project remains suspended and locked, while we are also being billed. We want to complete remediation immediately, including revoking/rotating exposed credentials, reviewing IAM and service accounts, deleting any unauthorized resources, checking logs, and reviewing billing usage. But the current suspension prevents us from doing so.
Could a Googler or Community Manager please look into this Ticket ID or advise on the correct escalation path?
We urgently need:
1. Manual review of the repeated suspension.
2. Reinstatement or temporary/limited access so we can complete remediation.
3. Guidance on how to revoke exposed credentials and delete unauthorized resources while the project is suspended.
4. Escalation to the appropriate Trust & Safety and/or Cloud Billing team regarding the charges.
The project owner can provide full ownership verification, email threads, billing details, and payment records through private or official Google support channels. We will not share sensitive billing information publicly.
Thank you.
