Railway says stolen customer AI keys drove $740,000 in unauthorized charges
Original title: Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
An attacker decrypted secrets in at most about 100,000 workspaces; Railway will cover some charges providers will not refund.
Railway said customer AI provider keys stored as environment variables were stolen in an October breach and used for an estimated $740,000 in unauthorized spending. The attacker exploited a previously unknown build-isolation flaw, obtained internal credentials, and decrypted variables in at most 1.85% of workspaces. Railway says it will pay charges that Anthropic and OpenRouter will not refund, and customers must rotate keys themselves.
Unconfirmed: The report does not explain how the $740,000 figure was estimated, and about 100,000 workspaces is an upper limit.
- Linked-account tokens for 1,852 users were reset, with no stolen-credential logins found.
- The attacker also read stored histories of 353 builds, including passed secrets.
- Forensics showed no customer database access and no downloaded code repositories.
- The first exploit was at 07:28 UTC on October 20; decryption followed on October 21.
- AWS and Google have started fraud refunds; OpenAI reviews claims case by case.
Impact: Stolen AI keys and other secrets used for unauthorized charges
| Product | Affected |
|---|---|
| Railway | — |
- 1.Revoke and replace sensitive variables stored on Railway before October 21.
- 2.Rotate keys with the issuing provider; a charge report does not revoke them.
- 3.Remove public database access and review GitHub and registry audit logs.
From the original article
6 min read at thehackernews.com
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them. The company builds and runs apps for its customers and stores their secrets, such as API keys and database
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.