Railway Breach Cost Hits $740,000 as Stolen AI Keys Resold

Attackers ran up an estimated US$740,000 in unauthorized AI usage after breaching application hosting platform Railway last month, the company said in a post-mortem. That figure is a company estimate, not an audited total. It equals roughly US$25,000 in fraudulent consumption every hour of a 30-day month.

What did the attacker actually reach?

Railway's incident report puts the blast radius at specific numbers. The intruder decrypted stored environment variables for at most 1.85 per cent of workspaces — about 100,000 of them. The haul also included linked-account tokens, among them GitHub OAuth tokens, for 1,852 users.

Database logs show the attacker was selective, not opportunistic. Queries picked out variables whose names matched AI provider keys. The attacker favored customers with large numbers of stored variables, Railway said.

That pattern matters. It suggests the intrusion targeted AI spend deliberately. It was not collateral damage from a general-purpose compromise.

How did the intrusion unfold?

The attack began on October 20. The attacker exploited a previously unknown flaw in Railway's build infrastructure to read files on a host virtual machine and steal a build credential.

That credential had a narrow intended purpose: tasks such as pushing container images. But an internal workflow system accepted it as a trusted client anyway. The result: exposure of the stored histories of 353 builds and a copy of Railway's source code repository.

With the source code in hand, the attacker found a wrongly configured identity binding in the deployment pipeline. From there, the attacker reached a machine holding a credential capable of decrypting customer variables.

Railway evicted the intruder on October 21. One day of access produced a six-figure bill. The company called its response a "contest of agent speed," and said unpublished evidence indicated the attacker used abliterated AI models — models with their safety restrictions stripped out.

Note what is missing here. The evidence of AI-driven attack tooling was not published, and Railway offered no independent verification. Readers should weigh the claim accordingly.

Who pays the $740,000 bill?

Liability currently depends on the provider, and the providers are splitting sharply.

• Amazon Web Services and Google: refunds have begun under their fraud policies.
• OpenAI and SpaceXSI: claims are under case-by-case review.
• OpenRouter: enforcing the no-refund clause in its terms of service.
• Anthropic: still in discussions when the report was published.

Railway said it will cover losses that providers do not refund. That is a promise without a stated cap. If the full US$740,000 lands on Railway, the company has not disclosed what that does to its finances.

Railway also theorizes the keys were on-sold for distillation — querying a commercial model at scale to train a copy. The company admitted it has not established whether the attacker ran the resale services involved. The theory is plausible. It is also unproven.

Is Railway an isolated case?

No. Earlier this week, Nvidia-backed AI inference provider Fireworks AI linked a breach of its systems to a criminal group engaged in LLMJacking — theft of access to large language models through stolen cloud credentials or API keys, with the access resold and the victim left holding the usage bill.

Among the Fireworks customers affected was Notion, the workspace app combining notes, documents, wikis, databases and project tracking, now with AI features layered on top.

Google-owned security vendor Wiz reported late last month that at least nine AI developer platforms, Fireworks among them, had disclosed security incidents in October. The list has since grown to 15.

What do the losses look like across the sector?

The numbers from adjacent breaches give the scale.

Wiz said it traced two stolen enterprise keys to one of those breaches. Attackers used them to make about 800,000 and 1.7 million calls to Amazon's Bedrock AI service — likely more than US$100,000 in usage at list prices.

Separately, Google's Threat Intelligence Group (GTIG) and Mandiant reported fraudulent charges exceeding US$100,000 in a single day at some victims, with totals reaching US$1 million.

The sector-wide picture is clear and worsening. Fifteen platforms disclosed incidents in a single month. Two keys produced 2.5 million API calls. One day of attacker access cost some victims six figures.

For enterprises, the lesson from Railway is procedural. Store AI provider keys as high-value secrets, rotate them, and treat environment variables as exposed by default. The refunds are trickling through. The attack surface is not shrinking.