Railway Breach: Hackers Stole Customers' AI Keys and Ran Up About $740,000 in Charges

Developer cloud platform Railway has published a detailed account of the October attack on its infrastructure, and the headline figure is striking: attackers who decrypted customers' environment variables used stolen AI provider keys to generate roughly $740,000 in unauthorised usage. The report went live on November 10 and was also reported by BleepingComputer.

A 26-hour cat-and-mouse game

Railway describes the incident not as a single break-in but as a contest lasting about a day, in which its engineers were hardening systems while the attacker, apparently aided by AI agents, probed multiple routes in parallel. "This was not a single breach followed by a single fix," the company wrote. Key moments from its timeline (UTC):

• October 18: the attacker started creating dummy accounts, initially without success;
• October 20, 07:28: a previously unknown flaw in Railway's build infrastructure let the attacker partly escape filesystem isolation and grab an internal credential;
• the same day, stored histories of 353 builds were read and Railway's internal source code was copied;
• October 21: a misconfigured OIDC trust relationship yielded a short-lived cloud credential, which was used to query the secrets database — prioritising AI provider key names — and decrypt values;
• October 21, about 09:25: the attacker was fully evicted.

How many customers were exposed

Railway puts the upper bound at 1.85% of workspaces, or about 100,000. It stresses that this is a ceiling rather than a confirmed count, because its logs identify environments, not individual variables. Linked-account tokens, including GitHub OAuth tokens, were reset for 1,852 users. The company says it found no evidence that customer Git repositories were downloaded or that customer databases were accessed.

Customers were told to rotate their secrets on October 22. New signups were paused until November 2, and the incident was reported to the FBI's Internet Crime Complaint Center.

Who pays for the stolen AI usage

Forensics suggest AI keys were the main prize, possibly for resale or for model distillation. Railway says AWS Bedrock and Google Gemini are applying their existing fraud refund policies, other providers are reviewing cases individually, and Railway itself will cover anything providers decline to refund.

On the engineering side, every build now runs on its own short-lived virtual machine with a narrowly scoped credential, critical CI actions require two-factor and biometric approval, all encrypt and decrypt operations are logged, and service accounts have moved to short-lived, minimal-privilege credentials.

Why it matters

The case shows how the economics of credential theft have shifted. A key to a popular AI model is close to cash: every request is billed to its owner, and costs can climb into thousands of dollars within hours. According to BleepingComputer, security firm Wiz has tied this kind of activity to a broader wave of attacks on developer platforms that it calls "Black October."

One detail in the timeline stands out: the decryption that mattered happened nearly 15 hours after Railway's responders were already engaged. Detection alone did not protect customer secrets — what counted was how quickly every route in could be closed, and attackers working with automated tools could move fast.

The lessons for developers are straightforward: put spending caps on AI keys, rotate them regularly, and avoid giving any secret stored in a hosting platform more power than the application truly needs.