// AI threat desk · 15 Nov 2026
Home/LEAK · Data Leaks
Data LeaksMediumAIUSECVSS not assigned

Railway attack exposed customer variables and enabled unauthorized AI usage

Railway said an October attack exposed variables in at most 1.85% of workspaces. Railway estimated unauthorized AI usage from stolen keys at about $740,000. It published its incident report Nov 10.

· 3 min read
AI-generated image of a security analyst reviewing cloud access and AI usage dashboards in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • Railway said an attacker exploited its build infrastructure and decrypted variables from at most 1.85%, or about 100,000, of workspaces.
  • Railway said stolen AI-provider keys generated about $740,000 in estimated unauthorized usage.
  • Railway said the attacker’s decrypted data included BYOK agent keys and GitHub OAuth tokens for 1,852 users.

Railway published its incident report Nov 10, saying an attacker exploited its build infrastructure in an October attack, decrypted a subset of customer variables and that unauthorized spend on stolen AI-provider keys was estimated at about $740,000.

The affected data included stored histories of 353 builds, including sealed variables, as well as BYOK agent keys and GitHub OAuth tokens for 1,852 users. Railway said forensics did not indicate that customer databases were accessed.

Railway is a cloud platform that runs customer applications and their builds. The company said the attacker was fully evicted on Oct 21, while existing deployments remained online during the pause in new builds and deployments.

On this page

Railway traced the attack from build escape to decrypted variables

Railway said the attacker began probing its build infrastructure at 06:50 UTC on Oct 20 and exploited a previously unknown vulnerability at 07:28 UTC to partially escape filesystem isolation.

An alert about anomalous registry-service API calls paged the on-call engineer at 13:58 UTC. The attacker had read stored histories of 353 builds between 13:50 and 15:30 UTC, including sealed variables.

At 03:26 UTC on Oct 21, the attacker found an erroneously configured OIDC binding and obtained a short-lived cloud credential. Railway said the attacker then retrieved encrypted environment variables between 04:07 and 05:21 UTC.

Railway said AI keys were the attacker’s primary target

Railway said database logs showed the attacker querying variable names with attacker-provided regular expressions to prioritize AI-provider keys. The attacker decrypted some retrieved variables during two periods on Oct 21, from 04:42 to 05:14 UTC and from 06:36 to 07:15 UTC.

The company said its internal forensic investigation identified AI-provider keys as the primary target. Railway estimated unauthorized spend on the stolen keys at about $740,000.

Railway said the attacker’s first dummy-account signups began on Oct 18, but all attempts during that initial probing were unsuccessful.

Railway restored builds after pausing deployments and signups

Railway said it began restoring builds on Oct 22 at 03:32 UTC, starting with Enterprise workspaces. Pro workspaces followed at 06:29 UTC, Hobby builds at 21:08 UTC, and Free and Trial builds at 22:49 UTC.

The company paused new signups on Oct 22 at 19:06 UTC and reopened them on Nov 2. Railway said all existing user deployments stayed online while new builds and deployments were paused.

Railway said it notified GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe about potentially compromised keys at 09:25 UTC on Oct 21. It restored builds for all plans by 22:49 UTC on Oct 22 and reopened new signups on Nov 2.

The company said it has not established whether the original attacker operated those services or supplied credentials to other parties. Railway also engaged an external forensics company to investigate the malicious actor.

What to do now

  1. Remove public network access to databases.
  2. Rotate any sensitive variables and keys.
  3. Check your GitHub account audit logs and review all app access.
  4. Check audit logs within your registries such as Dockerhub.
  5. Rotate your keys stored on Railway if you signed up prior to Oct 21.

FAQ

What happened in the Railway attack?

Railway said an attacker exploited its build infrastructure, accessed stored build histories and decrypted a subset of customer variables. Railway said the incident led to about $740,000 in estimated unauthorized AI-provider usage.

How many Railway workspaces were affected?

Railway said variables were decrypted from at most 1.85%, or about 100,000, of workspaces. It also said decrypted data included linked-account tokens for 1,852 users.

Which data did the Railway attacker access?

Railway said the attacker read stored histories of 353 builds, sealed variables included. Railway said decrypted data included BYOK agent keys and GitHub OAuth tokens, while its forensics did not indicate that customer databases were accessed.

Were Railway customer applications taken offline?

Railway said existing user deployments remained online and running while new builds and deployments were paused. It restored builds for all plans by 22:49 UTC on Oct 22.

What should Railway customers do after the incident?

Railway advised customers to remove public database access, rotate sensitive variables and keys, and review GitHub and registry audit logs. Railway recommended that customers who signed up before Oct 21 rotate keys stored on Railway.

Sources

  1. Incident Report: October 21st Security Attack | Railway Blog, RailwayPrimary
  2. Preliminary Report: Oct 21st Security Incident | Railway Blog, RailwayPrimary
  3. Railway breach leads to $740,000 in fraudulent AI charges, BleepingComputer
  4. Railway Hack Stole AI Keys From Up to 100,000 Workspaces, ShiftDelete
  5. Railway urges users to revoke API keys after cyberattack exposes customer secrets, MediaNama
How we checked this story
ClaimSourceStatus
Railway said an attacker exploited its build infrastructure and decrypted variables from at most 1.85%, or about 100,000, of workspaces.RailwayAttributed
Railway said stolen AI-provider keys generated about $740,000 in estimated unauthorized usage.RailwayAttributed
Railway said the attacker began probing its build infrastructure at 06:50 UTC on October 20.RailwayAttributed
Railway said the attacker exploited a previously unknown build-infrastructure vulnerability at 07:28 UTC on October 20 to partially escape filesystem isolation.RailwayAttributed
Railway said an alert paged its on-call engineer at 13:58 UTC on October 20 about anomalous registry-service API calls.RailwayAttributed
Railway said the attacker found an erroneously configured OIDC binding and obtained a short-lived cloud credential at 03:26 UTC on October 21.RailwayAttributed
Railway said the attacker retrieved encrypted environment variables between 04:07 and 05:21 UTC on October 21.RailwayAttributed
Railway said the attacker prioritized AI-provider keys by querying variable names with attacker-provided regular expressions.RailwayAttributed
Railway said the attacker decrypted some retrieved variables between 04:42 and 05:14 UTC and between 06:36 and 07:15 UTC on October 21.RailwayAttributed
Railway said the attacker was fully evicted from its systems at 09:24 UTC on October 21.RailwayAttributed
Railway said decrypted data included BYOK agent keys and GitHub OAuth tokens for 1,852 users.RailwayAttributed
Railway has not established whether the original attacker operated the services that relayed or resold access to AI providers.RailwayAttributed
Railway said forensics did not indicate that customer databases were accessed.RailwayAttributed
Railway said it notified providers about potentially compromised keys at 09:25 UTC on October 21.RailwayConfirmed
Railway said builds were restored for all plans by 22:49 UTC on October 22.RailwayConfirmed
Railway said it paused new signups on October 22 and reopened them on November 2.RailwayConfirmed
BleepingComputer reported that Railway’s breach generated approximately $740,000 in fraudulent AI usage.Railway, via BleepingComputerAttributed
ShiftDelete reported that Railway published its detailed incident report on November 10, three weeks after the attack.ShiftDeleteAttributed
MediaNama reported that Railway initially suspended new builds and deployments while investigating the incident.MediaNamaAttributed
Railway said the attacker’s first dummy-account signups began on October 18 and those initial attempts were unsuccessful.RailwayAttributed
Railway said customer applications stayed online while new builds and deployments were paused.RailwayConfirmed
Railway said it engaged an external forensics company to investigate the malicious actor.RailwayConfirmed
blog.railway.com published its report on Nov 10, 2026.blog.railway.comConfirmed
blog.railway.com published its report on Oct 22, 2026.blog.railway.comConfirmed

Could not verify

  • How the approximately $740,000 usage estimate was calculated is not established
agents
See all in Data Leaks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok