Attackers who breached cloud hosting provider Railway used stolen customer API keys to generate approximately $740,000 in unauthorized AI charges, the company disclosed in a Nov. 10 incident report. Railway says it will reimburse affected customers when AI providers decline to refund the fraudulent usage.
The attack occurred Oct. 20–21 and involved multiple infrastructure weaknesses that allowed the intruders to access encrypted customer secrets and obtain the credentials needed to decrypt some of them. Railway estimates that environment variables in up to 100,000 workspaces could have been exposed.
The company's investigation found that attackers specifically prioritized AI provider credentials, which Railway believes were intended for resale or use in AI model distillation. The suspected distribution network and the identities of those responsible remain unconfirmed.
Attackers exploited multiple weaknesses to reach customer secrets
According to Railway's incident report, the intrusion began at 7:28 a.m. UTC on Oct. 20, when attackers exploited an unknown vulnerability in the company's build infrastructure.
The flaw allowed a partial escape from filesystem isolation, exposing an internal credential used by Railway's build services.
Attackers subsequently used that credential to retrieve stored build histories and a copy of Railway's internal source code. They examined the code for additional access paths and discovered an incorrectly configured OpenID Connect (OIDC) trust relationship.
By Oct. 21, the attackers had obtained temporary cloud credentials, moved into internal infrastructure, and accessed a credential capable of decrypting customer environment variables.
Railway's database logs show that the attackers searched specifically for AI provider keys. Additional queries targeted cloud, database, and payment-service credentials.
The company detected suspicious activity at 1:58 p.m. UTC on Oct. 20 and fully removed the attackers by 9:24 a.m. UTC the following day.
Railway says it has remediated the exploited weaknesses and moved builds to dedicated ephemeral virtual machines with stricter access controls.
How many customers were affected?
Railway confirmed several distinct categories of exposure:
- Up to 100,000 workspaces: Environment variables belonging to at most 1.85% of workspaces could have been decrypted. This represents a maximum potential exposure, not a confirmed victim count.
- 1,852 users: Linked-account tokens, including GitHub OAuth tokens and bring-your-own-key AI agent credentials, were confirmed decrypted. Railway reset the tokens and notified affected users.
- 353 build histories: Attackers accessed stored build histories containing build-related information and secrets.
- $740,000: Railway's estimate of fraudulent AI usage associated with compromised credentials.
Railway found no evidence that customer Git repositories were downloaded or that customer databases were accessed. It also identified no logins to Railway accounts using credentials stolen during the incident.
The compromise resembles other attacks against developer platforms. In October, a Zeabur breach exposed millions of environment-variable records and raised similar concerns about secrets stored in hosted development infrastructure.
Stolen AI credentials generated unauthorized usage
Railway believes the attackers targeted AI keys for distribution through services that relay or resell access to commercial models.
This activity is often described as LLMjacking, in which stolen API credentials are used to consume paid AI services without the account owner's authorization.
Railway's investigation identified unauthorized requests involving coding agents and AI training-related workloads. The company suspects some credentials were used for model distillation, where outputs from one model help train another.
However, Railway has not identified the operators of the suspected distribution services or confirmed whether the original attackers controlled them.
Similar credential-theft risks appeared in the LiteLLM supply chain attack, which involved malicious packages designed to steal tokens and sensitive infrastructure data.
Railway reverses its reimbursement position
Railway initially told affected customers on Oct. 26 that it could not refund charges generated through compromised API keys.
Its Nov. 10 report introduced a different commitment: the company will coordinate refunds with AI providers and cover token-related losses when providers refuse reimbursement.
The company's reported arrangements include:
- AWS Bedrock and Google Gemini: Refunds have been initiated under existing fraud policies.
- OpenAI: Customers must open support cases and provide case IDs to Railway for coordinated review.
- Anthropic: Railway will cover affected charges while discussions with the provider continue.
- OpenRouter: Railway will cover losses because the provider is maintaining its no-refund policy.
- SpaceXSI: Claims are being reviewed individually through coordinated support.
Railway has asked customers to report unauthorized charges. Its announcement does not establish that all affected customers have received reimbursement.
What security teams should do after the Railway breach
Railway advises customers to revoke and replace sensitive credentials stored in the platform before Oct. 21, even if no suspicious activity has been identified.
Recommended actions include:
- Rotate exposed credentials. Revoke potentially compromised API keys through the issuing provider and replace them in dependent applications.
- Review usage and billing. Examine AI provider logs for unexpected requests, unfamiliar workloads, and unauthorized charges.
- Audit connected accounts. Check GitHub, cloud services, container registries, and database access logs for suspicious activity.
- Restrict permissions. Use narrowly scoped credentials and separate keys for different workloads wherever supported.
- Configure usage controls. Apply API quotas, spending limits, and anomaly alerts when providers offer them.
- Report fraudulent charges. Preserve billing evidence and submit claims through Railway and the affected AI provider.
Security teams should also verify that old keys have been revoked, not merely deleted from application configuration.
Research into AI-enabled credential theft has documented attackers using automated tools to discover and validate exposed credentials across cloud and AI services.
Railway says it has strengthened secret storage, restricted decryption permissions, and introduced centralized logging for encryption and decryption operations.
The company has also reported the incident to the FBI's Internet Crime Complaint Center and continues working with external forensic investigators.
The investigation has not established the attacker's identity or the ultimate destination of the stolen credentials. Railway plans to share additional indicators of compromise publicly after receiving approval from law enforcement.
For affected organizations, credential rotation and provider-side billing reviews remain necessary even after Railway's infrastructure remediation. Stolen API keys can continue authorizing external services until those credentials are invalidated.
Also read: A second Fireworks AI breach exposed Notion AI chat transcripts, extending the consequences of compromised cloud infrastructure to downstream customers.