Railway says hackers stole customer auth secrets and ran $740,000 in fraudulent AI usage
Railway, a cloud hosting provider, says attackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets.
Written by a model from the sources below. Verify against them.
- Vendor
- Railway
- Product
- Railway cloud platform
- Status
- Confirmed
- Disclosed
- Data taken
- Tokens and keys, Source code
- BleepingComputer: “The attack began on October 20, when hackers exploited a previously unknown vulnerability in Railway's build infrastructure to escape filesystem isolation and…”
- Exploited vulnerability
- BleepingComputer: “Railway believes the attackers were focused on stealing AI credentials for resale or use in AI model distillation, linking the incident to a recent wave of att…”
- Black October
Summary
The company says the attackers generated about $740,000 in fraudulent AI usage and that credentials for up to 100,000 workspaces could be exposed.
What to do
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it
For tokens and keysCheck whether your secrets or data were in its code
For source codeRotate Railway tokens, API keys, and other authentication secrets now
Review Railway workspaces and AI usage for unexpected activity or charges
Enable two-factor authentication on your Railway account
Check Railway's official status and security notices for updates on scope
Timeline
- Made public by BleepingComputer
- First seen by cve.now
- Confirmed by Railway
BleepingComputer: “In a new incident report published today, Railway confirms that attackers gained access to its internal source code and the decrypted customer environment vari…”
What was taken
| Taken | Per the source |
|---|---|
| Tokens and keys | BleepingComputer: “Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately…” |
| Source code | BleepingComputer: “In a new incident report published today, Railway confirms that attackers gained access to its internal source code and the decrypted customer environment vari…” |
Evidence 4
- SocialBluesky
“Railway Reveals How Hackers Used AI Agents to Steal API Keys and Rack Up $740,000 in Charges”
- PressBleepingComputer
“Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces.”
+1 more: BleepingComputer on Bluesky - SocialBluesky
“Cloud hosting provider Railway has disclosed a significant security breach in which attackers…”
- SocialMastodon
“attackers exploited infra flaws to steal customer auth secrets, then ran ~$740,000 of AI compute on victims' accounts.”
Corrections
- Changed “Tokens and keys of 1,852 users were exposed” to “Tokens and keys were exposed”.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the Railway breach
Was Railway breached?
Yes. Railway says so: “In a new incident report published today, Railway confirms that attackers gained access to its internal source code and the decrypted customer environment variables for at most 1.85% of its workspaces, or approximately 100,000.” (BleepingComputer).
What data was exposed?
Tokens and keys, Source code.
What should Railway customers do?
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Check whether your secrets or data were in its code. Rotate Railway tokens, API keys, and other authentication secrets now. Review Railway workspaces and AI usage for unexpected activity or charges. Enable two-factor authentication on your Railway account. Check Railway's official status and security notices for updates on scope.