Can you get any information about the party who stole your credentials? What were the domains and urls? What is the domain whois (probably private), their IP's? Where are they hosting? This information might help you make a case of fraudent abuse of your GCP account.