Railway breach leads to $740,000 in fraudulent AI charges

A leaked credential at Railway was confirmed used by an attacker before it was revoked.

Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate about $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces.

The company disclosed the incident on October 22, warning customers to rotate their secrets after detecting unauthorized access to systems storing environment variables.

In a new incident report published today, Railway confirms that attackers gained access to its internal source code and the decrypted customer environment variables for at most 1.85% of its workspaces, or roughly 100,000.

The company says this figure represents the maximum number of potentially impacted workspaces, rather than the confirmed number whose secrets were stolen.

The attack began on October 20, when hackers exploited a previously unknown vulnerability in Railway's build infrastructure to escape filesystem isolation and obtain an internal credential.

Anyone connected to Railway through the compromised trust relationship is potentially affected, not just Railway itself.

The attackers then exploited a second vulnerability involving an improperly configured trust relationship to gain further access to Railway's infrastructure and obtain credentials used to decrypt customer environment variables.

The stolen credentials were later used to generate about $740,000 in unauthorized AI usage, with Railway working with affected providers to reimburse customers.

There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.

The attackers used the credential to access stored build histories and retrieve a copy of Railway's internal source code, which they then analyzed to identify further ways to compromise the platform.

The breach also exposed linked-account tokens belonging to 1,852 users, including GitHub OAuth tokens and AI agent keys.

The trust mechanism involved here is an OAuth or access token, which is what let access move between otherwise unrelated systems.

Railway says the attack became a roughly 26-hour battle between its engineers and threat actors using AI-powered agents to identify and exploit vulnerabilities across its infrastructure.

Railway says its investigation found that the attackers specifically searched for AI provider credentials, although some queries also targeted cloud, database, and payment service credentials.

Railway has confirmed exploitation occurred before the credential was revoked.

Railway says it reset those tokens and notified affected users.

If you have any integration or dependency involving Railway, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.