Breaches · 1 day ago
Railway says attackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and run up about $740,000 in fraudulent AI usage, with credentials potentially exposed across as many as 100,000 workspaces.
The breach therefore has two distinct consequences: the unauthorized AI consumption is confirmed, while stolen secrets could provide a route into customer workspaces and connected services. Railway has not established that all 100,000 workspaces were accessed or that the secrets were used beyond generating the charges.
For Railway customers, the bill is not a measure of the incident’s boundary: if a stolen credential can reach a hosted project or linked service, exposure could extend beyond Railway’s AI usage. The report does not say which secrets were taken or whether any such access followed.
3 sources covering this story
Hackers stole AI credentials to get $740,000 in free compute; Railway picked up the bill
Attackers used Railway customer credentials for fraudulent AI usage, exposing how stolen machine identities can fuel model distillation while spreading costs across legitimate customers.
Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
Railway says stolen AI API keys caused $740,000 in unauthorized charges after attackers decrypted secrets in up to 100,000 workspaces.
Railway breach leads to $740,000 in fraudulent AI charges
Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces.
Part of the PlainSec briefing for 2026-11-12