Cloud hosting provider Railway has shared new details of its October security breach in an incident report published on Nov. 10, estimating that stolen credentials resulted in approximately $740,000 in unauthorized AI service charges.
Railway first disclosed the incident on Oct. 21, warning that attackers may have accessed sensitive environment variables, including API keys and database credentials. A preliminary investigation published the following day estimated that at most 1.85% of Railway workspaces, approximately 100,000, could have had some environment variables compromised.
The report states that the data decrypted by the attackers also included linked-account tokens belonging to 1,852 users, including GitHub OAuth tokens and bring-your-own-key (BYOK) agent credentials. The company has since reset these tokens and notified each affected user. It found no evidence that stolen credentials were used to access Railway accounts.
How attackers exploited weaknesses to steal AI credentials
According to Railway, the attackers initially exploited a previously unknown vulnerability in its build infrastructure, which allowed them to escape part of the filesystem isolation and obtain an internal credential.
Using the compromised build credential, the attackers gained access to internal systems and then exploited a misconfigured OpenID Connect (OIDC) binding to obtain cloud credentials. This allowed them to move laterally through Railway’s infrastructure, ultimately retrieving and decrypting a subset of customer environment variables.
Railway’s investigation revealed that attackers specifically searched for AI provider credentials. Stolen credentials were later linked to various unauthorized activities, ranging from coding-agent requests to AI training-related workloads, which Railway said was consistent with the credentials being passed through services that relay or resell access to AI providers.
“We have not established whether the original attacker operated those services or supplied credentials to other parties,” said Railway.
The company is working with affected AI service providers to secure refunds and says it will cover losses that providers do not reimburse. It also confirmed that it has since remediated the exploited vulnerabilities, introduced dedicated virtual machines for individual builds, strengthened internal access controls and implemented additional protections around secret storage and decryption.
Railway encouraged customers who have detected unauthorized AI service charges to report them through its incident report form. It also advised affected users to revoke or rotate compromised API keys.
