STOLEN AI KEYS RAN UP A $740,000 BILL — AND 100,000 WORKSPACES MAY HAVE LEAKED

Railway's final incident report, published November 10, says attackers who broke into the hosting platform in October ran up about $740,000 in unauthorized charges on stolen customer AI keys. The attack began October 20 through an unknown flaw in Railway's build infrastructure and took about 26 hours to fully evict; in that window the intruders could have taken decrypted environment variables from at most 1.85% of workspaces — roughly 100,000 as an upper bound, not a confirmed count.

The haul also included linked-account tokens for 1,852 users and the histories of 353 builds. Railway says the attackers specifically searched for AI provider credentials, and it will cover the charges itself if providers decline refunds. The customer database was not accessed, and no account logins with stolen credentials have been seen.