On a Monday morning, a billing alert reveals that an SME dashboard shows tens of thousands of francs in usage in forty-eight hours, on artificial intelligence services that no one in the company has ever enabled. The bill can reach several hundred thousand francs before the mechanism is understood. The scheme, known in the industry as LLMjacking, consists of hijacking a company’s access keys to consume, at its expense, artificial intelligence services resold to third parties. It is aimed precisely at companies that think they are not a target.
The mechanism, in plain terms
It all starts with a compromised access key, namely a technical identifier, a string of characters that allows your applications to consume remote IT services and that is left where it should not be, for example in a public code repository, on an infected developer workstation or on an external provider’s machine. Fraudsters no longer even need to look for them themselves, since bots constantly scan public repositories and spot an exposed key within minutes.
The fraudster then appropriates your billing capacity. With the key, they activate the most expensive AI models on the market, then resell access to hundreds of anonymous users via relay servers. Each request, each line of generated text, is billed to your account. The scheme was described by Sysdig researchers in May 2024, who estimated that the cost to the victim could exceed 46,000 dollars per day.
The scheme is brutal because the provider bills by usage, with no default cap, so that the meter keeps running as long as the key works.
Why your SME is exposed
Three weaknesses facilitate this scheme. Access keys with overly broad permissions, created for a test and never revoked. Billing with no maximum budget and no aggressive alerts, because historical usage was modest and no one imagined a hundredfold increase. And the absence of any monitoring of call logs, the only way to see that at three in the morning, your account is generating text continuously for unknown users.
None of these gaps is exotic. It is the everyday reality of a company that digitized quickly and effectively, without a dedicated security team, which is precisely the profile of Swiss SMEs.
The first 48 hours
The first step is to revoke immediately all access keys on the account, not just the one that appears compromised. Fraudsters often create new ones as soon as they have access. At the same time, disable AI services at the organization level, set spending caps and billing alerts, and change administrator access.
Next, preserve the evidence. Access and consumption logs are your case file, since they establish the geographic origin of requests, their volume and how clearly unrelated they are to your business. Export them without delay, as some providers keep them only for a few weeks.
The third front is the bill. Dispute it in writing, immediately, without waiting for the debit. A letter that sets out the compromise, quantifies the fraudulent usage, and reserves all rights is nothing like a resigned support request. Above all, do not pay without reservation. Where Swiss law applies, a person who voluntarily paid what was not owed can recover it only by proving the payment was made in error (Art. 63 para. 1 CO), so any payment made to avoid a suspension of service should be accompanied by an express written reservation. The law chosen in the terms and conditions must be checked.
For a business, the first 24 hours after an incident are described on arnaques-suisse.ch, businesses.
What the terms and conditions say
The terms and conditions of major providers are unambiguous on one point, namely that safeguarding credentials is the customer’s responsibility and that any activity carried out using its keys is deemed to be its own. Added to this are liability caps indexed to amounts paid, exclusions for indirect damages, and, frequently, a choice of law and foreign forum. Prima facie, the ground is unfavorable.
Yet you must read those same terms to the end. They generally provide a deadline for disputing invoices, sometimes thirty days from issuance, whose effect depends on the contract and the applicable law, so the safest course is to dispute the bill in writing before it expires. They impose a claims procedure that must be followed formally, failing which the provider will raise a procedural defect before any debate on the merits. Finally, they reserve mechanisms for credits or adjustments for abnormal usage, applied at the provider’s discretion, which leaves room for negotiation.
That leaves the substantive argument. Where usage increases a hundredfold in two days, from jurisdictions unrelated to the customer and on services never previously enabled, the provider, which deploys for its own needs some of the most sophisticated anomaly-detection systems on the market, can hardly maintain that it could not see anything. Billing without blinking for the consequences of detectable fraud raises questions about good faith in the performance of the contract. Without carrying the day on its own, the argument structures the negotiation. The dispute, detailed and supported by the logs as well as by the provider’s own clauses, is addressed to its legal department rather than to customer support.
A criminal complaint formalizes the case
The complaint structures the case, since it fixes, as of a certain date, the compromise, its discovery, the measures taken and the quantified loss. By filing the complaint, the injured company acquires the status of private claimant (Art. 118 paras 1 and 2 CrimPC) and presents itself, both to the provider and to the insurer, as the victim of offenses rather than as the distracted debtor of an IT services invoice.
The characterization depends on the scheme. Accessing the account with a stolen key is unauthorized access (Art. 143bis para. 1 SCC). Using the services billed to the victim may constitute fraudulent use of a computer (Art. 147 SCC) or obtaining a service by fraud, which targets anyone who uses a computer without paying and is prosecuted only on complaint (Art. 150 SCC). Unauthorized access is likewise prosecuted only on complaint, which must be filed within three months from the day the company learned who the offender is (Art. 31 SCC). Where the offender remains unknown, a complaint against persons unknown can be filed without waiting for the outcome of the billing dispute.
The complaint also opens the way to criminal seizure (Art. 263 para. 1 CrimPC), which may cover assets belonging to third parties, to tracing of the infrastructure used and to international mutual assistance. The fact that the perpetrators operate from abroad does not prevent proceedings, since Swiss authorities in principle have jurisdiction where the result of the offense occurs in Switzerland (Art. 8 para. 1 SCC). Even without rapid identification of the perpetrators, the procedure documents the company’s diligence.
The board of directors must protect itself
A six-figure incident is a matter for the company’s corporate bodies. Art. 716a CO places the organization and overall supervision of management among the non-transferable duties of the board of directors. Keys exposed for months, the absence of any billing cap, and a basic security failure can support a liability action (Art. 754 CO), brought as the case may be by a shareholder or, in the event of bankruptcy, by the bankruptcy estate.
The response comes down to two documents. A board resolution noting the incident, mandating the legal steps, and approving the remediation plan. And an independent security report establishing the cause of the compromise, the corrective measures, and their effective implementation. This resolution-report pair documents the directors’ diligence, strengthens the company’s position with the insurer, and shows the provider that it is dealing with an organization that takes the incident seriously.
The three fronts on which these cases are decided
These cases are often lost before they are even argued, on three distinct fronts.
First, the complaint. A generic complaint that speaks of “hacking” without describing the mechanism gives the investigation little to go on. A precise complaint, which correctly characterizes the offenses, reconstructs the chain of compromise, attaches sorted and readable logs, and identifies the infrastructure used, offers the public prosecutor something to work with. The prosecutor must understand the scheme in ten minutes of reading.
Next, the provider. Facing a counterpart that handles thousands of claims, tone decides a great deal. Grievances end up in a queue and empty threats shut down the discussion. What works is a cooperative but firm letter, grounded in the provider’s own clauses, precisely quantifying the fraudulent usage and placing the institution before a measurable procedural and reputational risk. In our experience, the same file, presented differently, moves to another desk, leaving customer support for the legal department, where negotiation takes place.
Then there is the technical side. Reading the logs requires distinguishing legitimate usage from fraudulent usage and working with the technical teams as well as with the expert appointed for the security report, so that understanding the mechanism determines the quality of the complaint as well as that of the negotiation.
Frequently asked questions
What is LLMjacking?
The hijacking of a company’s access keys to consume, at its expense, artificial intelligence services that are then resold to third parties. The victim keeps its data but receives the bill for massive usage it never ordered.
Does the provider have to cancel the bill?
Not automatically. The terms reserve adjustments for abnormal usage, which the provider grants at its discretion. The dispute must follow the procedure and deadlines provided and rely on logs that demonstrate detectable anomalies.
Does my insurance cover this type of loss?
Depending on the policy, fraud involving billed services does not always fall within the classic definitions of loss linked to cybercrime. Report the claim immediately, provide the complaint and the security report, and have the clauses reviewed before accepting a refusal.
Do I really need to file a complaint if the perpetrators cannot be found?
Yes. Even without rapid identification of the perpetrators, the procedure freezes the evidence, strengthens your position with the provider and the insurer, and may be joined to ongoing international investigations into the same infrastructure.
About the author
Matthias Traussnig is a lawyer admitted to the Geneva Bar and the founder of Sentinel Legal. He holds a CAS in Digital Finance Law from the University of Geneva, where he also teaches on fraud related to digital assets, and his practice covers white-collar crime, criminal law and technology law.
On these types of cases
Once the matter takes a criminal turn, it is handled by our criminal law practice in Geneva.
Such cases involve, at the same time, securing evidence in the first hours, the contractual showdown with the provider and the criminal and governance structuring. Sentinel Legal handles these matters, in white-collar crime and technology law, from disputing the bill to filing a criminal complaint and advising the board of directors. To discuss a situation, the firm can be reached on +41 22 512 76 00 or via the contact form.