Railway has confirmed that stolen customer AI provider keys led to approximately $740,000 in unauthorized usage charges following an October data breach. The platform-as-a-service provider stores customer secrets such as API keys and database credentials as environment variables and has pledged to cover charges that providers decline to refund.
The attacker decrypted variables in at most 1.85 percent of workspaces, roughly 100,000 in total, after targeting queries for AI provider keys. Additional data exposed included linked-account tokens for 1,852 users, specifically BYOK agent keys and GitHub OAuth tokens, all of which were reset. No evidence emerged of logins to customer accounts using the stolen credentials or access to customer databases and code repositories.
Provider-Specific Refund Policies
Refund terms differ across providers according to the incident report:
- AWS Bedrock and Google Gemini apply existing fraud policies, with account teams already processing refunds.
- OpenAI reviews claims case-by-case; customers must file directly then share the case ID with Railway support.
- Anthropic discussions continue, with Railway covering interim costs.
- OpenRouter maintains its no-refund policy, so Railway will absorb all related breach costs.
Customers are advised to revoke and rotate any sensitive variables stored before October 21 and to remove public network access to databases while checking audit logs.
Attack Timeline and Root Cause
The breach began in the build system on October 20 when an attacker exploited an unknown flaw to escape filesystem isolation and obtain a credential for pushing images. This allowed access to the internal Temporal system and the company monorepo. A misconfigured OIDC binding later granted cloud credentials that enabled decryption of customer variables via the KMS root key. The attacker was evicted by 09:24 UTC on October 21.
Railway has since moved all users to short-lived isolated virtual machines, closed every exploited weakness, and filed a complaint with the FBI IC3 while cooperating with forensics specialists.
