Stolen AI keys from Railway ran up an estimated $740K. How to tell if yours were hit
Quick answer: Railway, the app-hosting platform, published its full incident report on Nov 10, 2026. An attacker got into its systems on Oct 20-21 and decrypted stored environment variables for at most about 100,000 workspaces (1.85% of the total). Railway says the attacker mainly searched for AI provider keys, and estimates about $740,000 in unauthorized AI usage on the stolen keys. The 100,000 figure is an upper bound, not a count of confirmed victims. If you stored secrets on Railway, rotate them at the provider that issued them. (Railway incident report, Nov 10)
What happened
- The attacker first escaped build isolation using a previously unknown vulnerability on Oct 20, then used a misconfigured cloud login setting (an OIDC binding) on Oct 21 to reach internal credentials and, with them, the database of encrypted environment variables.
- Railway says it could confirm that at most 1.85% of workspaces, about 100,000, could have had environment variables decrypted. The logs identify environments, not individual variables, so that figure is an upper bound.
- The attacker also read the stored histories of 353 builds, including secrets passed to those builds.
- Railway says database queries prioritized AI provider key names. One query also matched cloud, database and payment-service credentials. Forensics did not indicate customer databases were accessed, and Railway has no indication that customers’ code repositories were downloaded.
- Linked-account tokens (AI agent keys and GitHub OAuth tokens) for 1,852 users were also decrypted. Railway reset all of them, notified each user, and found no logins to Railway accounts using the stolen credentials.
- The report says OpenCode, Warp, Fireworks AI and others disclosed similar key thefts between Oct 6 and Oct 23, and calls this one of a series of attacks on platforms that hold AI keys.
Am I affected?
- Who could be: anyone whose environment variables or build secrets lived on Railway around Oct 20-21, especially AI provider keys. Railway emailed customers it judged at high risk, so check your inbox and spam for a note from Railway.
- Who probably isn’t: Railway says only a subset of workspaces were at risk, and it can’t say which individual variables were taken.
- What was not reported: customer databases being accessed, or customer code being downloaded.
How to check
- Look for a Railway email about the incident, including spam.
- Check usage and billing at each AI provider (OpenAI, Anthropic, Google, AWS Bedrock, OpenRouter and others) for requests or spend you don’t recognize since Oct 20. Railway says the stolen keys were used for work ranging from coding agents to AI training pipelines.
- List what you stored on Railway: AI keys, cloud keys, database URLs, payment keys, GitHub tokens.
What to do
Railway’s advice, as summarized by The Hacker News, is to revoke and replace any sensitive variable that was stored on the platform before Oct 21. Rotate keys with the provider that issued them; filing a charge report with Railway does not revoke a key.
- Rotate AI, cloud, database and payment keys that were stored on Railway.
- Report charges you didn’t make through Railway’s charge report form so it can help you get compensated.
- Refunds depend on the provider, per Railway: AWS Bedrock and Google Gemini refunds have started under their fraud policies. OpenAI and SpaceXSI review case by case (file a claim with the provider, then pass the case ID to Railway). Railway is talking to Anthropic and covering Anthropic key costs in the meantime. OpenRouter keeps its no-refund policy, and Railway says it will cover those costs. Railway says it will cover token losses providers decline to refund.
- Open questions: The Hacker News notes the report does not say how the $740,000 figure was estimated or what period it covers, and neither the report nor the form sets a deadline or cap for claims.
FAQ
Was my database stolen? Railway says forensics did not indicate customer databases were accessed. Database credentials stored as variables could have been decrypted in at-risk workspaces, so rotate them anyway.
How many people were hit? At most about 100,000 workspaces had variables that could have been decrypted. Railway does not give a confirmed count.
Will I get my money back for fraudulent AI charges? Railway says it is working with providers on refunds and will cover charges providers won’t. Terms differ by provider.
Is the attack over? Railway says the attacker was expelled on Oct 21 and every weakness it exploited has been closed. A forensics firm’s investigation is ongoing.
Sources
- Railway, “Incident Report: October 21st Security Attack” (Nov 10, 2026): https://blog.railway.com/p/incident-report-october-security-incident
- The Hacker News, “Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges”: https://thehackernews.com/2026/11/railway-says-stolen-customer-ai-keys.html
- BleepingComputer, “Railway breach leads to $740,000 in fraudulent AI charges”: https://www.bleepingcomputer.com/news/apple/railway-breach-leads-to-740-000-in-fraudulent-ai-charges/
— AltTab Dad