Railway Says Hackers Ran Up $740,000 on Stolen AI Keys, With Up To 100,000 Workspaces Exposed
Railway says attackers who breached it in October ran up about $740,000 in unauthorized charges on customer AI keys, and decrypted secrets for at most about 100,000 workspaces. Whether developers get that money back depends on which AI vendor sent the bill.
Somebody ran up a bill of roughly $740,000 on AI models, and it was not the people who owned the keys. That is the headline number in the incident report Railway published on Nov 10, its detailed post-mortem of an October intrusion. The keys belonged to Railway customers, and the charges landed on accounts that never asked for them.
The exposure figure needs careful handling. Railway says the attacker obtained and decrypted "a subset of customer variables, for at most, 1.85% (~100,000) of workspaces." The company is explicit that this is a ceiling. Its logs identify a subset of environments, not individual variables, "so that figure is an upper bound." As BleepingComputer put it, the number is the maximum of potentially impacted workspaces, "rather than the confirmed number whose secrets were stolen." So no, 100,000 customers were not confirmed breached. Railway just cannot rule them out.
Railway was one of the nine platforms caught up in the October wave we covered in Wiz's tally of hit AI developer platforms. What is new here is Railway's own accounting of what the theft cost.
A shopping list written in regular expressions
According to the report, this was not a smash and grab for whatever happened to be lying around. Railway says database logs show the attacker "specifically prioritizing AI provider keys" in its queries and going after customers with large numbers of stored variables. An additional query also matched cloud, database and payment credentials, though Railway says forensics did not indicate customer databases were accessed.
The company says the intrusion began with a previously unknown flaw in its build infrastructure on Oct. 20 and that the attacker was fully evicted by 09:24 UTC on Oct. 21. Railway says every vector used has since been remediated.
"The escalating situation became a contest of agent speed, with Railway defending against abliterated models and a harness similar to ARTEX, according to Wiz." Railway incident report
Why AI keys? Railway says it believes the credentials "were passed on to distributed transfer stations for use for distillation." That is Railway's assessment, not an established fact, and the company itself says it has "not established whether the original attacker operated those services or supplied credentials to other parties."
The haul was not limited to API keys. Railway says decrypted data included linked-account tokens, BYOK agent keys and GitHub OAuth tokens, for 1,852 users. It says it reset every one, notified each user and found no logins to Railway accounts using credentials taken in the incident.
Then comes the bill. Railway says unauthorized spend on the stolen keys "was estimated to reach ~$740,000" and that it is working with providers on refunds while "backstopping it from our own balances for those unwilling to do so."
Who actually pays depends entirely on whose model got hammered. By Railway's account "at the time of writing," AWS Bedrock and Google Gemini are refunding under existing fraud policies, OpenAI and SpaceXSI are reviewing claims case by case, talks with Anthropic are ongoing with Railway covering those costs meanwhile, and OpenRouter is holding the line.
"While OpenRouter has decided to enforce their no-refund policy as per their Terms of Service, we will be covering all costs associated with this breach in relation to OpenRouter." Railway incident report
Credit where it is due. Railway is promising to eat what vendors will not, and asks customers to report charges they did not make. But the patchwork is the real story. A developer whose key leaked from the same database could get a quick fraud refund, a case review or a flat no, depending purely on which provider sat behind the key.
The bigger lesson is uglier. A hosting provider sitting on a pile of customer AI keys is, in Railway's own reading of the logs, exactly what the attacker came for. Railway says it has since rebuilt its build isolation, CI pipeline and secret decryption controls. Customers storing pay-as-you-go model keys anywhere should assume that bill is a target too.
