Now Hacked
EN-GB
Data breach

Railway hack exposes customer AI keys, incurs $740,000 in unauthorised charges

First reported · Last reported · 10 related reports

Railway's internal systems were breached on 21 October, exposing customer secrets and disrupting build, deployment and management services. A subsequent investigation confirmed that the attacker decrypted environment variables from up to approximately 100,000 workspaces and stole customers' AI service API keys. The company estimated unauthorised usage charges at approximately $740,000, recommended rotating keys and said it would cover costs that providers do not refund.

Key facts

Affected organisation
Railway
Incident type
Data breach
Occurred / detected
2026-10-21
Scale of damage
Environment variables from up to approximately 100,000 workspaces exposed and approximately $740,000 in unauthorised AI usage charges
Cause / method
Exploitation of a vulnerability in internal infrastructure to decrypt environment variables and steal customers' AI service API keys
Location
United States

If your data was exposed

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.

Timeline

  1. A breach of internal systems exposed customer secrets and disrupted build, deployment and management services.
  2. Railway published a preliminary report and recommended that customers rotate stored keys.
  3. Railway disclosed approximately $740,000 in unauthorised usage charges and its commitment to cover unrefunded costs in a detailed investigation report.

10 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.