Railway details intrusion involving AI-provider keys and about $740,000 in unauthorized spending

Railway says probing of its build infrastructure began at 06:50 UTC on October 20.[1] At 07:28 UTC, the attacker exploited a previously unknown flaw to partially escape filesystem isolation and read files on a host machine.[1] Those files exposed a credential that build servers used to authenticate to some internal systems, including to push completed images.[1] Railway says its internal Temporal instance, used for builds, accepted the compromised credential as a trusted client.[1] The account describes an initial build-system flaw followed by access that relied on trusted credentials.[1]

The attacker read stored histories from 353 builds, which included variables and secrets passed to those builds.[3] Railway says an incorrectly configured OIDC binding exposed a short-lived cloud credential to the attacker at 03:26 UTC on October 21.[1] The attacker used that credential to retrieve internal credentials and an SSH key, then connected to a machine running fleet orchestration tasks.[1] Railway says that machine held a longer-lived credential capable of decrypting encrypted customer variables.[1] The attacker's database queries specifically searched for AI-provider key names.[2] Railway believes the attacker sought those credentials for sale to distributed transfer stations for model distillation.[1]

Railway estimated unauthorized spending at approximately $740,000.[2] It says stolen data included linked-account tokens for 1,852 users, which the company reset.[2] Railway says investigators found no customer-account logins using stolen credentials and no evidence that customer databases were accessed.[2] Those findings describe what the investigation had established; Railway has not established whether the intruder operated services that may have received stolen keys.[2] Railway also cautioned that the roughly 100,000-workspace figure is a maximum, not a confirmed count of workspaces whose secrets were stolen.[2]

Railway says engineers were alerted to anomalous registry API calls at 13:58 UTC on October 20.[1] The company describes the response as a contest of agent speed; according to Wiz, the attacker used abliterated models and a harness similar to ARTEX.[1] Railway says it fully evicted the attacker by 09:24 UTC on October 21 and invalidated every user session and token at 20:19 UTC that day.[1] It halted builds twice and restored builds for all plans by 22:49 UTC on October 22.[1] Railway advised customers to revoke and replace sensitive variables stored on the platform, and says it will cover breach-related charges when providers decline reimbursement.[3][2]