Railway's full report on its October 21 breach says the attacker decrypted variables in up to 1.85% of workspaces, about 100,000, and that stolen AI keys ran up an estimated $740,000. AWS Bedrock and Google are refunding fraud; Railway says it will pay Anthropic and OpenRouter charges itself. File a charge report and rotate anything stored before October 21.
If you ran anything on Railway before October 21 and got a surprise bill from an AI provider, file Railway’s charge report now. Railway’s full incident report, published November 10, says stolen customer AI keys ran up an estimated $740,000 in unauthorized usage, and the company says it will pay those charges itself where the AI provider refuses to refund them.
What changed
Railway is a platform that builds and hosts apps for developers and stores their secrets, such as API keys and database passwords, as environment variables. Its incident report adds three facts to the preliminary report from October:
- Scope. The attacker decrypted variables in at most 1.85% of workspaces, about 100,000. Railway’s logs show which environments were exposed but not which variables, so that number is an upper limit.
- Target. Database logs show the attacker searched specifically for AI provider keys and for customers with many variables. Railway believes the keys were resold to services that relay access to AI models. One query also matched cloud, database and payment credentials; Railway says forensics showed no customer databases were accessed.
- Money. Railway puts unauthorized spend on the stolen keys at about $740,000. That is a reversal: in an October 26 update, according to The Hacker News, Railway told customers it could not refund spend made with compromised keys.
The decrypted data also held linked-account tokens, BYOK agent keys and GitHub OAuth tokens, for 1,852 users. Railway says it reset all of them, notified each user and found no logins with stolen credentials. The attacker also read the stored histories of 353 builds, including the variables passed to them.
Who refunds what
Railway lists each provider’s policy at the time of writing:
- AWS Bedrock and Google Gemini: existing fraud policies apply, and their account teams have started refunds.
- OpenAI: open a support request with OpenAI, then give the case ID to Railway support. The two companies review cases one by one.
- SpaceXSI (Grok): contact Railway support with the claim; reviewed case by case.
- Anthropic: talks are ongoing. Railway says it is covering Anthropic charges from stolen keys itself in the meantime.
- OpenRouter: it is enforcing its no-refund terms, so Railway says it will cover all OpenRouter costs from the breach.
The report does not say how the $740,000 was estimated, and neither it nor the claim form sets a cap or a deadline. According to The Hacker News, the form itself says Railway “is not responsible for usage of these keys,” which sits awkwardly next to the promise to pay. Keep your provider invoices either way.
What to do now
- Rotate at the source. Revoke and replace every sensitive variable you stored on Railway before October 21, with the provider that issued it. Filing a charge report does not revoke a key.
- Do not read a revocation email as proof of exposure. Railway sent hashes of every key it held to GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe, so reset notices reached more than 100,000 users.
- Check your bills for October 20 onward at every AI provider, then file the charge report for anything you did not run.
- Close the side doors. Remove public network access to databases, review GitHub audit logs and authorized apps, and check registry logs such as Docker Hub.
Railway paid the price for a shared build system
The attack started on October 20 with an unknown flaw that let the attacker partly escape a build’s filesystem isolation and grab a credential build servers used. That credential worked far beyond pushing images: Railway’s internal build scheduler trusted it, which exposed other builds’ secrets and a copy of Railway’s own monorepo. From the code, the attacker found a misconfigured cloud identity binding and reached the machine holding the key that decrypts customer variables.
Railway says each build now gets its own short-lived virtual machine with a credential that can push one image and nothing else, and that only its secrets service can decrypt variables. Those are the right fixes. The lesson for teams is older: one platform holding every key is one breach away from every bill. Railway is one of at least nine AI developer platforms Wiz counted in its “Black October” analysis, alongside Northflank, Nvidia Brev and Trigger.dev. Set a spending limit at each AI provider so a stolen key hits a ceiling. Google now offers one for the Gemini API; see how Google Cloud spend caps work.