$213,000 — a hacked account ran Lambda in six regions overnight and support first said it was on you

What happened

A self-described AWS beginner, u/Mundungu, found their account compromised at the end of July. Overnight, over just a few hours, an attacker spun up AWS Lambda in region after region, including Tokyo, Sydney, Ireland, Paris, the US, and Sao Paulo, with hundreds of thousands of requests in each. Most of the charges were Lambda GB-seconds, with a few thousand more in CloudWatch fees. The poster got no notification until they opened a support ticket on July 28. The original bill came to $213,000. For about four weeks AWS support went back and forth, at first reassuring the poster that this kind of thing happens and not to worry, then shifting to say they were now liable for most of the amount and replying with copy-pasted messages that they had done everything they could. The poster took a day off work to look for an attorney and described it as one of the worst months of their life.

Root cause

The account was compromised through leaked credentials. The poster later linked the pattern to the Denonia malware, which targets AWS Lambda environments. Because AWS has no hard spend cap, credentials plus API access let an attacker fan out compute across every region in parallel and rack up six figures before any billing alert catches up. The poster had even set a $1 monthly budget while securing the account, but as they noted, an attacker inside the account could simply remove it. Billing metrics that feed alerts can lag hours to days, so overnight abuse is largely done before a threshold trips.

How to avoid it