An expensive Tuesday can start with a perfectly ordinary alert.
Your cloud account has used more computing power than expected. Finance assumes someone ran a large report. IT assumes the development team is testing something. Everyone has a plausible explanation, so the bill waits until Friday.
Meanwhile, the meter keeps running.
Unexpected cloud usage deserves a prompt security check alongside the usual cost investigation. An attacker who gets access to rented computing power can put it to work for their own purposes. Your business gets the invoice. A generous arrangement, from their perspective.
The warning in Kernel’s disclosure
Kernel’s 4 November disclosure describes attackers accessing GPU servers and starting a cryptominer. That puts a practical business risk into focus: someone can misuse computing capacity you’re paying for.
Cryptomining uses computing power to process cryptocurrency-related calculations. When attackers run it on someone else’s infrastructure, they avoid paying for that power themselves.
You don’t need to operate GPU servers for the broader lesson to matter. Cloud accounts can provide access to paid computing resources, and unauthorised activity can generate charges.
Kernel’s disclosure doesn’t tell us what’s happening inside your account. It does offer a useful reason to review how quickly your business would spot unexpected usage, investigate it and stop it safely.
Bring finance and IT into the same conversation
Cloud cost reviews often begin with sensible commercial questions. Has demand increased? Did a project need extra capacity? Has a service become more expensive?
Add a security question early: can we explain who started this workload and why?
Finance may notice the spending before IT notices the activity. IT may see an unusual login without knowing that charges have risen. Each team holds part of the picture.
Agree a simple route for joining those observations. A spending alert should reach someone who can examine the account, with a named deputy when they’re away.
Otherwise, the most important control in the process may turn out to be whether someone checks their inbox during lunch.
Know what normal usage looks like
A monthly budget is useful, but it’s a blunt instrument for spotting unusual activity. An account can stay below its overall limit while an unfamiliar resource runs up charges.
Build a working picture of normal usage for your main services. Record when computing demand usually rises and which types of resources the business expects to run.
A reporting job that runs overnight may be entirely legitimate. A newly created high-powered server running continuously deserves an explanation, especially if your business has never needed one before.
Where your provider supports them, use cost-anomaly alerts and usage alerts as well as budget notifications. Check reporting delays too. Billing information may arrive after the activity that generated it.
Alerts give you a chance to act sooner. They still need a person and a response process behind them.
Set limits before there’s a problem
Review which accounts can create expensive resources and how much capacity they can request.
Apply appropriate service quotas or policy restrictions where available. If your business has no reason to use a particular resource type or region, consider restricting it. Test changes against genuine business needs before applying them widely.
Keep routine user permissions narrow. Use multi-factor authentication, particularly for privileged accounts, and protect credentials used by scripts and automated services. Those credentials need appropriate permissions and a process for replacing them if exposed.
Separate development and production environments where practical. This can make spending easier to understand and help contain the consequences of a compromised account.
Also confirm what a budget alert actually does. An email warning generally shouldn’t be mistaken for a hard spending cap. Provider controls differ, so check the behaviour rather than relying on the label.
Investigate the workload, not just the invoice
When spending jumps, establish which resource generated the charge and when it started. Then compare that activity with approved work.
Ask the relevant team to confirm the purpose. Check account activity records for resource creation, permission changes and unfamiliar access. Preserve useful logs before routine retention periods remove them.
An unfamiliar server isn’t proof of a breach. It could be a test environment someone forgot to stop. Equally, a familiar account name doesn’t prove the activity was authorised.
Look for evidence that connects the workload to a genuine business task. If nobody can account for it, treat that uncertainty seriously and involve whoever handles your security response.
This keeps the investigation grounded. You’re establishing what happened, rather than choosing between panic and a hopeful shrug.
Stop the spending without losing the evidence
If you suspect unauthorised activity, follow an agreed incident process. Record affected resources and relevant account activity, then contain the access and workload using steps appropriate to the situation.
That may involve disabling compromised credentials, restricting network access or stopping affected computing resources. Get qualified support where needed, particularly if customer-facing systems share the environment.
Deleting everything immediately can remove evidence needed to understand how access was gained. Leaving everything running while people debate the bill carries its own risks. A prepared response plan helps your team make those decisions deliberately.
Check for other resources the attacker may have created. Stopping the first suspicious workload won’t necessarily remove the route back in.
Contact the cloud provider promptly about the incident and associated charges. Keep records, but don’t build your recovery plan around an assumed refund.
Make the next alert easier to handle
You can start with one cloud account this week.
Check who receives its spending alerts. Confirm they can reach someone with access to investigate. Review whether expensive resources have appropriate restrictions, then walk through a hypothetical overnight spending spike together.
The useful outcome is a short, workable response: who checks the activity, who can contain it and who makes decisions if an important service is affected.
Cloud cost optimisation includes spotting waste and choosing suitable capacity. It also means noticing when someone else may be using your account for work you never authorised.
If your cloud bill and security checks currently live in separate conversations, talk to Morse Networks about bringing them together.
Let’s make IT one less thing to think about. morsenetworks.co.uk.
Sources
- November 4, 2026 Public Notice of Security Incident — Kernel Blog · 4 Nov 2026