Railway security incident history
Hacking, data breaches and other security incidents involving Railway, with related coverage.
Incidents: 1 · Most recent
Railway hack exposes customer AI keys, incurs $740,000 in unauthorised charges
Impact: Environment variables from up to approximately 100,000 workspaces exposed and approximately $740,000 in unauthorised AI usage charges
Railway's internal systems were breached on 21 October, exposing customer secrets and disrupting build, deployment and management services. A subsequent investigation confirmed that the attacker decrypted environment variables from up to approximately 100,000 workspaces and stole customers' AI service API keys. The company estimated unauthorised usage charges at approximately $740,000, recommended rotating keys and said it would cover costs that providers do not refund.
Related reports: 10 · last report →