Railway says breach led to $740,000 in AI charges

Railway said attackers stole customer credentials during an October cyberattack and used them to generate about $740,000 in unauthorized artificial intelligence usage charges. The cloud hosting company said its investigation found that attackers could have decrypted environment variables from at most 1.85% of its workspaces, or about 100,000. That is a potential maximum, not a confirmed count of compromised workspaces.

The intrusion began on October 20, according to Railway’s incident report, published November 11. Attackers exploited weaknesses in the company’s build and cloud infrastructure, moving from a credential used by build servers into internal systems. They ultimately accessed a machine holding credentials needed to decrypt customer environment variables.

Railway said attackers searched its production database for variables associated with AI providers, while also querying for some cloud, database and payment credentials. Stolen AI keys were then used for fraudulent activity across AI services, producing the approximately $740,000 in charges attributed to the incident. The company said it had no evidence that attackers accessed customer databases or downloaded customer...