Railway's breach report: stolen AI keys ran up an estimated $740,000 in charges

The cloud hosting platform Railway published its full incident report on 10 November 2026 about the attack on its systems on 20–21 October. Railway says an attacker got into its build infrastructure, decrypted customers' stored environment variables and used AI provider keys taken from them, with unauthorised usage it estimates at about $740,000.

If your team deploys on Railway and kept API keys for OpenAI, Anthropic, Google or other services in Railway variables, this report is worth reading closely.

What happened

According to Railway's report, the first exploit came at 07:28 UTC on 20 October and Railway spotted the intruder that afternoon. The attacker was fully removed at 09:24 UTC on 21 October. In between, the attacker moved step by step:

• escaped the isolation around a customer build;
• used a build credential that an internal system wrongly trusted;
• exploited a misconfigured identity setting in a cloud environment;
• reached a database of encrypted customer variables and used Railway's key service to decrypt some of them.

Environment variables are the settings and secrets an app reads when it runs, such as database passwords and API keys. That is why the attacker went for them.

The numbers Railway reports

• Up to about 100,000 workspaces (1.85%) could have had environment variables decrypted. Railway calls this an upper bound, not a count of confirmed victims.
• 353 builds had their stored history read.
• 1,852 users had linked-account tokens reset, including GitHub sign-in tokens and AI keys they had connected to Railway's own agent features.
• About $740,000 in estimated unauthorised spend on stolen keys.

Railway says the attacker was after AI provider keys, and that it found no evidence that customer databases were accessed.

Who pays for the stolen usage

This is the part business owners will care about. Railway's report sets out where refunds stand with each AI provider:

• AWS Bedrock and Google Gemini: fraud is covered under their existing policies.
• OpenAI: reviewed case by case through a support case.
• Anthropic: still in discussion; Railway says it is covering costs from breached keys in the meantime.
• OpenRouter: does not give refunds, so Railway says it is covering those costs.

Railway asks customers to report unexplained charges through a form linked in the report.

What Railway changed

Railway halted builds during the attack, invalidated all sessions and tokens on 21 October, and restored builds by plan tier on 22 October. New sign-ups were paused on 22 October and reopened on 2 November. The report says builds now run in a separate short-lived virtual machine each time, and that Railway has reported the attack to the FBI's Internet Crime Complaint Center and brought in a forensics firm.

Limits of what we know

The figures above are Railway's own and some are estimates. The 100,000 figure is the most that could have been exposed. Refund terms are as Railway describes them; check directly with your AI provider for your account.

What to do this week

• Rotate every secret that sat in a Railway variable on 20–21 October, starting with AI keys, payment keys and database passwords. Railway's step-by-step guides for Anthropic keys and OpenAI keys cover deleting the old key, creating a new one and redeploying.
• Check usage per key in each AI provider's console for late October onward. Look for spend you can't explain.
• Report unexplained charges to Railway through its form, and open a case with the AI provider.
• Set spending limits and alerts on every AI account, so a stolen key can only cost so much before someone is told.
• Use separate keys per app and environment, so one leak is easy to trace and switch off.

The DevDrift helps teams set up AI integrations with per-app keys, spending limits and audit trails.

Sources

• Railway: Incident Report, October 21st Security Attack
• Railway: Check for Unexpected Anthropic Usage
• Railway: Check for Unexpected OpenAI Usage