Railway discloses breach exposing up to 100,000 workspaces and $740,000 in fraudulent AI charges

Intruders used a flaw in Railway’s build infrastructure on October 20, 2026 that had not been seen before to escape filesystem isolation and take an internal credential. Railway said it found the breach after spotting unusual activity in systems holding customer environment variables.

With that credential, the attackers looked at stored build histories for 353 builds that held sealed variables and took Railway’s internal source code. They also used an improperly configured trust relationship to reach deeper systems and take credentials for decrypting customer environment variables. Railway said its engineers fought threat operators running AI-powered agents in a battle that lasted roughly 26 hours, and that all exploited vulnerabilities were fixed. It also said intruders were fully evicted from its systems, with the eviction completed on October 21, 2026.

Attackers took tokens for linked accounts belonging to 1,852 users, including OAuth tokens for GitHub and keys for AI agents. Their queries focused on AI provider credentials, though they also searched for cloud, database and payment credentials. Railway said it saw no evidence that intruders downloaded customer Git repositories or entered customer databases. Intruders may have exposed credentials for as many as 100,000 workspaces, but Railway described that figure as an upper bound of potentially affected workspaces, not a confirmed count of stolen secrets.

Railway said intruders used flaws in infrastructure to take customer authentication secrets and generate about $740,000 in fraudulent AI usage. Railway said it believes the intruders wanted AI credentials to resell or to use in AI model distillation. Railway said it became aware of the key access at 9:25 a.m. UTC on October 21, 2026 and told upstream providers such as GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI and Stripe to revoke keys that might have been compromised.

Railway reset the tokens for those users and told them about the reset. On October 22, 2026, the company reset bucket credentials and GitHub tokens and said earlier credentials would no longer work. The company paused deployments and told customers to replace credentials while it investigated, temporarily stopped new deployments and later brought its build service back online. Applications stayed online while builds were paused twice and every session was logged out, and users who rotated keys could not redeploy and faced downtime.

Railway told customers to rotate environment variables, replace API keys and private registry credentials, and check service logs for suspicious activity. Railway advised all users to revoke and reapply sensitive environment variables before October 21, 2026. The company said two categories carried risk: workspaces holding many environment variables and environments with many AI keys from vendors. It also told users to remove public network access to databases and to check audit logs for GitHub accounts and registries such as Docker Hub.

Taylor Monahan, a blockchain investigator, tied the incident to suspected theft of roughly USD 371,000 in crypto across at least 19 Ethereum-compatible networks. Monahan said the first known theft transaction took place at 19:36 UTC on October 21. She identified 0xd9773325282874d18cb83f1fe50f14c39750b2ee as a suspected attacker address. Railway has not verified those cryptocurrency losses and has not determined how many customers were affected.

Dick O’Brien of Symantec Threat Hunter Team said his team saw no evidence linking its observed activity to the Railway incident.

OpenAI and SpaceXSI review claims individually, while AWS Bedrock and Google Gemini have begun fraud refunds. Discussions with Anthropic continue and Railway is covering those costs in the meantime, while OpenRouter keeps a no-refund policy that Railway will pay itself.

Railway said the incident was part of a “Black October” wave dubbed by Wiz that targeted AI development platforms such as Northflank, OpenCode, Warp and Lightning AI. The company stopped new signups between October 22 and November 2, 2026, and filed a complaint with the FBI’s IC3 while hiring an outside forensics firm.

Railway rebuilt its CI pipeline using two-factor authentication and biometric approval. It reduced service accounts to minimum access, shifted to short-lived credentials, and centralized encryption and decryption logging.

ShiftDelete said users should check AI provider dashboards for usage spikes between October 20 and November 11. It also said users should set spending caps and alerts for every AI API key and use separate narrowly scoped keys per app.