When websites go wrong
Real incidents, explained with sources: what went wrong, why it happened and what it cost.
- Unexpected costs
A $7 Google Cloud budget. A $72,000 overnight bill.
His startup tested a new feature overnight. A bug made the code run in a loop, Google kept adding servers to keep up, and the bill reached $72,000 in a few hours. The $7 budget alert arrived a day late.
- Unexpected costs
A stolen API key led to $1,700 in unauthorised AI usage.
In 2026, attackers compromised a coding tool and abused API keys stored in it. One developer reported $1,700 in unauthorised AI usage before the company announced the incident.
- Data leaks
Jason's AI assistant deleted his whole customer database, then said it panicked.
In July 2025, Replit’s AI assistant deleted records for 1,206 executives and 1,196 companies from Jason’s production database, despite instructions not to make changes. The assistant then said recovery was impossible. Jason eventually restored the data himself.
- Data leaks
The Tea app exposed 72,000 verification images, including ID photos.
In July 2025, images from the Tea app’s storage were leaked, including verification selfies and identity documents. Around 72,000 images were shared online. A second breach exposed a database containing 1.1 million private messages.
- Legal complaints
Website owners faced €190 legal demands over Google Fonts.
In 2022 a Munich court awarded €100 damages because a site loaded a Google font without asking the visitor. Within months more than 100,000 German site owners received letters demanding €100 plus €90 in fees. Many paid before another court called the wave abusive.
- Legal complaints
A legal demand can cost an online shop around €1,300.
Figures cited in a German parliamentary document put the average cost of a legal demand against an online shop at around €1,300. A missing or incorrect legal notice can also lead to costs. Breaching a signed undertaking to stop an infringement may trigger further penalties.
- Unexpected costs
An empty storage bucket ran up a $1,300 bill in one day.
In April 2024 a developer created a private Amazon S3 storage bucket for a test. It was empty, yet within a day it received about 100 million requests from other people's misconfigured systems. AWS billed him more than $1,300, even though every request was rejected. AWS cancelled the bill and later changed its pricing.
- Data leaks
Badly configured Firebase databases exposed 19 million passwords.
In 2024 three researchers scanned more than five million websites and found 916 whose Firebase databases had missing or wrong security rules. Together they exposed about 125 million user records with names, emails and bank details, and around 19 million passwords stored as plain text. Only about a quarter of the owners fixed the problem after being told.
- Data leaks
A flaw in Base44 let strangers into private apps built with it.
In July 2025 the security firm Wiz found that anyone who knew an app's ID could sign up to private apps made with the AI app builder Base44, including company tools with HR data and internal chatbots. Even single sign-on could be bypassed. Base44's owner Wix fixed it within 24 hours and found no sign of abuse.
- Data leaks
A vibe-coded social network exposed 1.5 million API keys.
In 2026 Wiz found that Moltbook, a social network for AI agents built largely with AI, left its production database open. A key in the site's JavaScript gave anyone read and write access to about 1.5 million API tokens, some 35,000 email addresses and private messages, a few of which contained OpenAI keys.
- Legal complaints
A privacy group sent complaints to 560 websites over their cookie banners.
In May 2021 the Vienna-based group noyb sent draft complaints to 560 websites in 33 countries and gave each one month to fix its cookie banner before going to the regulator. Its software found that 81% offered no way to reject cookies on the first screen.
- Legal complaints
Austria's regulator ruled a website's use of Google Analytics unlawful.
In January 2022 the Austrian data protection authority found that an Austrian website broke EU privacy law by using Google Analytics, because visitor data went to Google in the US without adequate protection. It was the first decision on 101 complaints that noyb had filed across Europe.
Could your website have the same problem?
Send us a link to your website. We’ll reply within two working days, explain what we recommend checking and agree a fixed price before work starts.