Security · November 15, 2026
Hackers Spent 740,000 Dollars on AI Services After Railway Breach
Railway reported that attackers used stolen data to spend approximately 740,000 US dollars on artificial intelligence services following a security breach in October 2026.
The attackers decrypted secrets for approximately 1.85 percent of workspaces, which equals about 100,000 workspaces. This figure represents the maximum possible number of affected workspaces because company logs show which environments were accessed but not which specific variables were decrypted. Railway stated it will cover the costs if the artificial intelligence providers do not refund the victims.
The breach began on October 20 when hackers exploited a previously unknown vulnerability in the build infrastructure of Railway. This allowed them to partially bypass isolation and steal internal credentials. The attackers read data from 353 builds and copied the internal monorepository of Railway to study the code.
Following this, the hackers targeted a misconfigured OIDC binding in a cloud environment to obtain temporary cloud credentials and additional internal keys. They then connected via SSH to an orchestration machine, accessed a database containing encrypted environment variables, and extracted the credentials needed for decryption via KMS.
Railway specialists noted that the primary targets were access keys for artificial intelligence services, including OpenAI, Anthropic, Gemini, AWS Bedrock, and OpenRouter. The attackers specifically searched for variables with matching names. Some requests also targeted credentials for cloud services, databases, and payment systems. The company believes the stolen data may have been resold or used for model distillation. Analysts from Wiz grouped this and similar October incidents into a single event called Black October.
The leak also affected tokens for linked accounts of 1,852 users, including GitHub OAuth tokens and BYOK keys for artificial intelligence agents. Railway has reset these tokens and notified the affected users. No evidence was found that attackers accessed Railway accounts using the stolen data, nor was there evidence of client Git repositories or client databases being downloaded.
Railway has closed the vulnerabilities used in the attack. Every build now runs in a separate temporary virtual machine with credentials that only allow the upload of a specific image to the registry.