Railway puts a $740K price on the hack that hunted AI keys

Cloud host Railway says the attacker behind its October breach was mainly after AI provider keys, and that unauthorized spend on them is estimated at about $740,000. The figure comes from the company’s final incident report, published November 10 and picked up by Techmeme from BleepingComputer.

What the report says happened

According to Railway, the attacker was active from October 20 at 07:28 UTC until it was fully evicted on October 21 at 09:24 UTC. The company describes a chain of steps. First, an unknown flaw let the attacker partly escape build isolation on a shared virtual machine and read a build-server credential. That credential was trusted by an internal workflow cluster, which let the attacker read the stored histories of 353 builds, including sealed variables.

Later, Railway says, an erroneous OIDC binding in a cloud environment produced short-lived cloud credentials. Those led to an SSH key and, on an orchestration machine, a long-lived decryption credential. The attacker used it against the key management service to decrypt customer variables, according to the report.

Railway says the logs identify environments rather than individual variables, so it treats the scope as an upper bound: variables may have been decrypted for at most 1.85% of workspaces, roughly 100,000. Linked-account tokens for 1,852 users (agent keys and GitHub OAuth tokens) were reset, and Railway reports no logins to Railway accounts using credentials taken in this incident. It also says forensics found no evidence that customer databases were accessed.

The search terms point to AI keys

The most telling detail is what the attacker looked for. Railway says that between about 04:07 and 05:21 UTC on October 21 the attacker queried the variables database with regular expressions matching the names of AI provider keys, and ran a secondary query for cloud, database and payment credentials. It also says the attacker favored customers with many variables.

Railway believes the keys were passed to what it calls distributed transfer stations, meaning resale services that sell model access, and possibly used for distillation. It says the unauthorized usage ranged from coding agents to AI training pipelines, and that it cannot establish whether the original attacker ran those services. These are the company’s beliefs, not findings confirmed by a third party.

Who pays and what customers should do

Railway says it notified AI providers first, with hashed lists of keys, because it initially believed keys were the target, and notified users broadly later. It admits the delay was meant to validate impact and avoid re-exposure while the attacker was still inside, and says it plans a fixed window for impact assessment.

On refunds, the report gives a provider-by-provider picture:

• AWS Bedrock and Google Gemini have started refunds under existing fraud policies.
• OpenAI and SpaceXSI are reviewing cases one by one.
• Anthropic is in discussions, and Railway is covering costs from breached keys in the meantime.
• OpenRouter enforces a no-refund policy, and Railway says it is covering all related costs.

Railway says it will cover any shortfall from its own balances. Customers who see unauthorized charges should use the form linked in the report. Railway has also filed a complaint with the FBI’s IC3 and engaged a forensics firm, and says it will publish indicators of compromise after law enforcement approves.

On the engineering side, each build now runs on its own ephemeral VM with a credential limited to pushing one image, CI has been rebuilt with two-factor and biometric approval, and all encrypt and decrypt operations are audit-logged centrally.

One victim in a wider run on AI keys

Railway says OpenCode, Warp and Fireworks AI reported similar thefts between October 6 and 23, and it cites Wiz research it calls “Black October” on a related resale pattern, without attributing this incident to it. Our own coverage of the Fireworks breach showed that one attack reached customer datasets, partial model weights and billing data, so the targets were not limited to keys.

The pattern explains why platforms that merely store keys for developers are now prime targets: a leaked key is billable the moment it works. Security firm METR, for example, was reported by ITPro to have faced a $600,000 AI bill after keys were taken, unnoticed for weeks. At roughly $740,000, Railway’s estimate is of the same order, though it covers a platform with up to 100,000 exposed workspaces.

What the report does not settle

The $740,000 is an estimate by Railway, not an audited total, and the 1.85% scope is a ceiling. The identity of the attacker is not given, and Railway says it cannot link the resale services to that actor. Railway also describes the attacker as using models with safeguards removed and moving at machine speed; that characterization is the company’s and Wiz’s, and the report offers no independent proof here. Developers who stored provider keys on Railway should still rotate them, since the exposure range is wide and providers were asked to revoke keys on their side as well.