Railway is a platform-as-a-service used to deploy applications. On 10 November 2026 it published its full incident report on a breach that ran across 20 and 21 October.
The company's own figure: "Unauthorized spend on the stolen keys was estimated to reach ~$740,000."
The chain
When (UTC) | What |
|---|---|
20 Oct, 13:50 to 15:30 | Attacker reads stored histories of 353 builds, sealed variables included |
20 Oct, 13:58 | Railway detects unusual registry API calls and becomes aware of unauthorized access |
21 Oct, 04:07 to 05:21 | Attacker pulls encrypted variables from the database, querying for names matching AI provider keys |
21 Oct, 07:14 | Railway disables all active cloud credentials, revokes static credentials, shuts off the key decryption service |
21 Oct, 09:25 | Notifies GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe with lists of potentially exposed keys |
22 Oct | Public disclosure, customers told to rotate secrets |
10 Nov | Full incident report |
The route in combined a build isolation escape with a cloud trust misconfiguration, which let the attacker move through internal systems and authenticate to the key management service to decrypt matching keys.
The scope
Up to around 100,000 workspaces, roughly 1.85% of the total. Railway frames this as the potentially exposed population, not a confirmed count of stolen secrets.
1,852 users had linked-account tokens stolen, including GitHub OAuth tokens and AI agent keys. Railway reset those and notified them.
No evidence of Railway account logins using stolen credentials, customer database access, or Git repository downloads.
The attacker has not been named. Railway believes the keys reached services that relay or resell AI access, potentially for model distillation, but says it has not established whether the attacker ran those services.
The attacker searched by name
This is the detail worth stopping on, because it tells you what changed.
The attacker did not take everything. Railway's forensic work found the queries were specifically for AI credentials, with some also targeting cloud, database and payment keys. The intruder pulled encrypted variables and looked for variable names that matched AI provider key patterns, then decrypted only the subset that matched.
That is a shopping list, not a smash and grab. Somebody knew exactly what they wanted, and what they wanted was the thing that converts directly into compute.
The term for the result is LLMjacking: using stolen credentials to consume paid AI services at the victim's expense. The usage Railway observed afterwards ranged from coding agents to AI training pipelines.
The part about who pays
Railway's position changed, and the change matters.
On 26 October, responding to customers asking about refunds, the company said "Railway is unable to refund customers for spend performed with compromised API keys," encouraging them to contact the AI providers directly and offering to escalate.
In the November report, it commits to covering breach-related charges itself where providers decline to reimburse, while working with providers on refunds.
That reversal is worth acknowledging rather than glossing over. The first position was defensible and common. The second is unusual, and it transfers a cost that would otherwise land on customers who did nothing wrong except store a key where the platform told them to.
For affected customers the practical sequence is still three-sided: claim from the AI provider first, report the charge to Railway, and expect Railway to cover what the provider refuses.
This is a campaign, not an incident
Railway is one of several. Wiz has catalogued the pattern as Black October, counting at least nine AI developer platforms that disclosed credential theft during the month.
Named alongside Railway: OpenCode, Warp, Fireworks AI, Northflank, Lightning AI and Zeabur. Railway's own report notes that OpenCode, Warp, Fireworks AI and others disclosed similar thefts between 6 and 23 October, and assesses its own breach as one of a series of attacks on platforms that hold AI keys.
Zeabur's separate breach reportedly produced around $100,000 in fraudulent charges. Reporting citing the Wall Street Journal puts combined losses above $1.1 million once roughly $371,000 in cryptocurrency theft is included.
The inference is straightforward. Platforms that store developer secrets have become a defined target category, because one intrusion yields thousands of keys that convert to money without any further exploitation.
What to do
If you used Railway
Rotate everything you stored there, not just AI keys. The October disclosure named API keys, database credentials and registry credentials.
Check provider billing from 18 October onward, across AI, cloud and payment providers. One customer described a Gemini key that billed $2.22 on 1 October, then $100 on 21 October and $200 on 22 October.
Claim unauthorized charges from the provider first, then report them to Railway through its form. For some providers Railway asks customers to open a vendor ticket and share the case ID.
Check whether you were in the 1,852. Those users had linked-account tokens reset, including GitHub OAuth.
If you store secrets on any platform
Assume your secrets store is a named target. The attacker searched by variable name. Generic names like
OPENAI_API_KEYare exactly what the query matched.Set hard spending limits on every AI provider account. This is the single control that caps the damage, and almost nobody sets it until after the first incident.
Turn on billing anomaly alerts and make sure someone reads them. In the example above, the customer missed an email headed with an unusual cost spike warning.
Scope keys tightly and rotate on a schedule, rather than creating one long-lived key with full access.
Prefer short-lived credentials or workload identity over static keys where the provider supports it. A key that expires is worth far less to resell.
Why this is different from an ordinary breach
Stolen credentials usually need work before they produce money. They get sold, tried against other services, used for access that leads somewhere else. There is a chain between theft and profit.
An AI provider key skips all of it. It is a bearer token for compute, billed to someone else, usable immediately, and liquid enough to resell to relay services. No lateral movement, no ransomware negotiation, no buyer for a database. The theft and the payday are the same action.
That is why nine platforms disclosed in one month, and why the attacker queried for key names rather than taking the database. The economics of credential theft changed when the credentials started pointing at metered compute, and the platforms holding those credentials have not finished adjusting.
