The Pulse

Railway estimates stolen keys led to about $740,000 in unauthorized charges

Railway estimates that stolen customer keys were used to incur about $740,000 in unauthorized spending after an October security breach. The company says variables in at most 1.85% of workspaces could have been decrypted.

AI.info Team · · fact-checked · against 1 source ↓ · Published 11 Nov 2026

Stolen customer keys incurred an estimated $740,000 in unauthorized spending after an October breach of Railway, the company said in an incident report. The attacker obtained and decrypted customer variables in at most 1.85% of workspaces, or about 100,000, according to Railway. The company said its logs identify environments rather than individual variables, making that figure an upper bound.

AI credentials targeted

Railway’s investigation suggests AI provider keys were the primary target, based on the attacker’s queries. It believes the credentials were passed to distributed transfer stations for use in distillation, but has not established whether the original attacker operated those services or supplied other parties.

The company said it has observed unauthorized use ranging from coding agents to AI training pipelines. Customer-provided examples included requests to coding agents, reviews of AI-agent behavior for training data, and checks of training tasks and their scoring systems.

How the attacker got in

The initial exploit occurred at 07:28 UTC on October 20, when the attacker used a previously unknown vulnerability in Railway’s build infrastructure to partially escape filesystem isolation and read some files on a host virtual machine. That access yielded a credential used by build servers to authenticate to some internal systems.

The attacker used it to read a limited set of stored build histories and obtained a copy of Railway’s internal codebase, the company said. An erroneous cloud configuration later allowed the attacker to obtain a short-lived cloud credential.

The attacker then reached an orchestration machine containing a longer-lived credential that could decrypt encrypted variables. Database logs showed queries prioritizing AI provider keys and customers with large numbers of variables, according to the report.

Customer exposure and response

Railway said the attacker also read the stored histories of 353 builds, including sealed variables. Decrypted data included linked-account tokens for 1,852 users, including agent keys and GitHub OAuth tokens. The company reset those tokens, notified the users and said it identified no logins to Railway accounts using credentials taken in the incident.

Another query matched cloud, database and payment-service credentials, although the company said its forensics did not indicate customer databases were accessed. Starting on October 21, Railway asked providers including GitHub, Anthropic, OpenAI, Google and Stripe to revoke potentially compromised keys.

The company said it notified providers first while securing its infrastructure because it could not yet assure customers that replacement credentials stored on Railway would remain protected. It halted builds twice and restored them for all plans by 22:49 UTC on October 22.

Existing deployments continued to run during the build pause, but Railway acknowledged that some customers experienced downtime after revoked credentials stopped services operating normally and they could not immediately redeploy. The company said it moved builds to infrastructure in which each build receives a dedicated ephemeral virtual machine.

Refunds and investigation

Railway is working with providers to refund unauthorized spending and said it would cover token losses where providers do not. At the time of the report, it was covering costs from breached Anthropic keys while discussions with that provider continued. Railway also said it would cover costs associated with the breach involving OpenRouter, which had decided to enforce its no-refund policy.

The company sent a formal complaint to the FBI’s IC3. A specialist forensics firm’s investigation remains ongoing.