Ad account compromise · Security & incident response
$41K+ hijacking, fully recovered.
Context
An advertising account compromised through unauthorized access, with malicious campaigns spending against the client's payment method over a short window.
Problem
More than $41,000 of unauthorized spend, active malicious campaigns, and no documented timeline of how access was obtained. First-line platform support was responding with templates, and the evidence needed for a credit claim was degrading by the day.
Role
My role: led the forensic response, the documentation, and the platform escalation end to end. Team: the client's internal IT secured the surrounding Google Workspace accounts.
Work
Contained the incident — access revoked, payment methods frozen, malicious campaigns paused — then reconstructed the access timeline from change history and account security events, separated malicious from legitimate spend, and prepared the unauthorized spend claim to a standard that would survive escalation past first-line support. Hardened the estate afterwards: two-factor enforcement, an access matrix rebuild, manager account isolation, and spend anomaly alerting.
Outcome
Full recovery of the $41,000-plus in unauthorized spend, and a hardened access model across the remaining accounts.