Now Hacked
EN
Data breach

Railway hack exposes customer AI keys, incurs $740,000 in unauthorized charges

First reported · Last reported · 10 related reports

Railway's internal systems were breached on October 21, exposing customer secrets and disrupting build, deployment, and management services. A subsequent investigation confirmed that the attacker decrypted environment variables from up to approximately 100,000 workspaces and stole customers' AI service API keys. The company estimated unauthorized usage charges at approximately $740,000, recommended rotating keys, and said it would cover costs that providers do not refund.

Key facts

Affected organization
Railway
Incident type
Data breach
Occurred / detected
2026-10-21
Scale of damage
Environment variables from up to approximately 100,000 workspaces exposed and approximately $740,000 in unauthorized AI usage charges
Cause / method
Exploitation of a vulnerability in internal infrastructure to decrypt environment variables and steal customers' AI service API keys
Location
United States

If your data was exposed

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.

Timeline

  1. A breach of internal systems exposed customer secrets and disrupted build, deployment, and management services.
  2. Railway published a preliminary report and recommended that customers rotate stored keys.
  3. Railway disclosed approximately $740,000 in unauthorized usage charges and its commitment to cover unrefunded costs in a detailed investigation report.

10 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.