Railway breach leads to $740,000 in fraudulent AI charges

Hackers broke into Railway's infrastructure, a cloud hosting service used by software teams.

The attack began on October 20, when they exploited vulnerabilities to access internal systems and customer environment variables, which can contain secret credentials.

Railway says up to 100,000 workspaces may have been affected, but that is a maximum estimate, not a confirmed count of stolen secrets.

The attackers searched for AI provider credentials and used stolen credentials to generate about $740,000 in unauthorized AI charges.

Railway says linked-account tokens for 1,852 users were also exposed, and it reset those tokens and notified affected users.

Railway is working with providers to reimburse customers and says it will cover charges that providers do not refund.

The company says the attackers were removed on October 21, the vulnerabilities have been fixed, and investigators found no evidence that customer code repositories or databases were accessed.