INC-006: The cloud account running a client's production apps wasn't mine

While recovering from INC-001, I checked who actually controlled the account. My own login had Administrator access, but ownership, billing and OTPs were tied to someone else's email. I worked out...

severity: SEV-2 | kind: near-miss | date: 2026-07 | duration: Caught before impact | status: RESOLVED

Impact

The Oracle Cloud tenancy hosting a client's production apps was owned by a friend's institutional email. Billing OTPs went to them, and a forgotten block volume was generating recurring charges. If that email had been deactivated or the bill left unpaid, the apps could have gone down with no way for me to fix it.

Summary

While recovering from INC-001, I checked who actually controlled the account. My own login had Administrator access, but ownership, billing and OTPs were tied to someone else's email. I worked out what I could change, and how to remove the recurring charge.

Timeline

• During the INC-001 recovery, reviewed the cloud account's users, ownership and billing
• Found the tenancy owner was a friend's institutional email; billing OTPs went there
• Confirmed my own account was an active Administrator user
• Found the recurring charge came from a block volume, not the free-tier VM

Root cause

The account was created by whoever was available at the time, and nobody wrote down who owned what. Ownership, billing and access were three different people's problem.

What didn't work

Action items

• [x] Verified my own Administrator access

Lesson

_Who owns the account is part of the infrastructure. You can have perfect backups and still lose everything because the billing email belongs to someone who graduated._

tags: cloud, oracle-cloud, billing, access-control