Cloud hosting platform Railway has published its full account of a security incident in October in which an attacker broke into its systems, decrypted customer secrets and ran up about $740,000 in unauthorised charges on stolen artificial intelligence provider keys.

The incident report, published on 10 November, says the attack ran from 20 to 21 October and that at most 1.85 per cent of workspaces — about 100,000 — could have had environment variables decrypted. Railway describes that figure as an upper bound, because its logs identify affected environments rather than individual variables.

How the attacker got in

The attacker began probing Railway's build infrastructure at 06:50 UTC on 20 October. At 07:28 UTC, the attacker exploited a previously unknown vulnerability in the multi-tenant build system to partly escape filesystem isolation and read files stored on the host virtual machine, including a credential that build servers use to authenticate to internal systems.

Railway's internal Temporal system, which schedules build tasks, accepted that credential as a trusted client. The attacker used it to read the stored histories of 353 builds, including sealed variables, and to retrieve a copy of Railway's internal source code repository, which gave the attacker a privileged view of how the platform works.

The attacker then found a second way in. After scanning the stolen code for escalation routes, the attacker exploited an incorrectly configured OIDC trust relationship in one of Railway's cloud environments at 03:26 UTC on 21 October to obtain short-lived cloud credentials. Those credentials led to a machine holding a longer-lived credential that could decrypt customer environment variables.

Between 04:42 and 07:14 UTC on 21 October, the attacker decrypted a subset of the encrypted variables it had retrieved. Railway disabled the credentials at 07:14 UTC and says the attacker was fully evicted from its systems at 09:24 UTC on 21 October.

What was taken and what it cost

Database logs show the attacker specifically searched for AI provider keys, using patterns matching variable names, and also targeted customers with large numbers of variables. Railway believes the keys were passed on for use in model distillation, a process that trains one AI model using the outputs of another.

Linked-account tokens belonging to 1,852 users, including their own AI provider keys and GitHub OAuth tokens, were also decrypted. Railway says it has reset every one of those tokens and notified each affected user, and it found no logins to Railway accounts using credentials taken in the incident.

Unauthorised spending on the stolen keys is estimated at about $740,000. Railway says AWS Bedrock and Google Gemini are refunding fraudulent use, while OpenAI and SpaceXSI are deciding case by case, and Railway is covering the cost of breached Anthropic and OpenRouter keys itself while talks continue.

Railway says its investigation found no evidence that customer databases were accessed, and no indication that the attacker downloaded snapshots or repositories belonging to customers. It has filed a complaint with the FBI's Internet Crime Complaint Center and engaged a forensics firm.

What Railway changed

During the incident Railway halted builds twice, rotated internal credentials and invalidated every user session and token at 20:19 UTC on 21 October. Builds were restored for all plans by 22:49 UTC on 22 October.

Each build now runs on its own dedicated short-lived virtual machine, with a credential that can only push that build's image to Railway's registry. Railway says the shared systems the attacker used are no longer in use, and every encrypt and decrypt operation is now logged.

The company continues to tell every customer who signed up before 21 October to rotate the secrets stored in Railway environment variables and to check the services those secrets unlock for misuse.

Frequently asked questions

How many Railway workspaces were affected?
At most 1.85 per cent of workspaces, about 100,000, could have had environment variables decrypted, according to Railway. The company calls that an upper bound.

What should Railway customers do now?
Railway says customers should rotate all secrets stored as environment variables and review usage logs with their AI, cloud and payment providers for the exposure window.

Were customer databases accessed?
Railway says its forensic investigation found no evidence that customer databases were accessed.

Sources: Railway incident report and TrustList.