Summary
- Railway's investigation found that attackers could have decrypted environment variables belonging to at most 1.85% of customer workspaces.
- Stolen AI service credentials generated approximately $740,000 in unauthorised usage, with the company coordinating reimbursements.
- Attackers chained an initial build-isolation weakness with a cloud identity configuration error, prompting major infrastructure changes.
A cyberattack against cloud development platform Railway exposed customer credentials and generated approximately $740,000 in unauthorised AI service charges, according to a detailed investigation describing how attackers moved between trusted infrastructure systems.
Railway published its final incident report on 10 November, adding substantially to the information available when it first asked customers to rotate potentially compromised secrets in October.
The company found that attackers could have decrypted environment variables belonging to at most 1.85% of customer workspaces, representing approximately 100,000 environments.
Railway emphasised that this is an upper bound derived from logs, not confirmation that every variable within those workspaces was accessed or decrypted.
The investigation also identified 1,852 users whose linked-account tokens were potentially exposed. Those tokens were reset, and affected users were notified. Railway found no logins to its accounts using stolen credentials from the incident.
Initial access crossed build-system boundaries
The attack began on 20 October when an intruder exploited a previously unknown weakness within Railway’s build infrastructure.
A partial escape from filesystem isolation allowed access to files on the underlying virtual machine. From that position, the attacker obtained a credential intended to authorise routine build operations.
An internal task-management service accepted the credential for a broader range of operations than intended, allowing the attacker to read stored build histories and limited internal source material.
Railway’s investigation found access to the histories of 353 builds, including information that could assist the attacker in understanding the platform’s internal architecture.
The company moved to contain this initial path, but the information and access already obtained enabled the intruder to investigate other trust relationships.
Cloud identity configuration created further exposure
In the next stage, the attacker exploited an incorrectly configured identity binding within a cloud deployment environment.
That allowed access to temporary cloud credentials and additional secrets used by internal infrastructure. The attacker then reached a system with connectivity to production services and the database used for storing encrypted customer environment variables.
Using compromised credentials, the intruder retrieved encrypted records and attempted to decrypt a subset of them through the platform’s key-management arrangements.
The company recorded which environments might have been affected, but the available logs could not identify every individual variable successfully extracted. That limitation explains the maximum exposure figure of 1.85%.
Railway reported that the attacker was fully expelled by 21 October and that no further access to customer data was observed after that point.
AI credentials were a principal objective
Forensic analysis showed that the attacker specifically searched for variable names associated with commercial AI providers. Other queries also matched cloud, database, and payment-related credentials.
Railway believes AI service keys were the primary target, potentially for distribution through services that provide unauthorised access to commercial models.
It has not established whether the original attacker operated those services or supplied stolen keys to other parties. Its investigation did not find evidence that customer databases were accessed.
Unauthorised usage observed after the intrusion included coding-agent and AI training workloads, illustrating how stolen API credentials can be monetised rapidly through consumption-based products.
Charges reached approximately $740,000
Railway estimates that misuse of compromised keys generated around $740,000 in charges. It has contacted relevant service providers to seek refunds and committed to supporting affected customers where providers do not reimburse them.
The resulting costs differ from traditional data-loss consequences. A stolen consumption-based credential can generate substantial financial exposure even when no customer database is copied or core service is permanently disrupted.
The risk depends on the permissions and spending limits associated with a credential, as well as the speed with which misuse is detected and access can be revoked.
Recovery required rebuilding trust
Railway halted builds during containment, rotated internal credentials, invalidated sessions and tokens, and rebuilt affected infrastructure. Builds were restored across plans by 22 October after significant hardening.
The company has since introduced dedicated temporary virtual machines for individual builds, narrowed service permissions, and strengthened controls around access to secrets.
Its final incident report describes the attack sequence, customer exposure, and remediation work.
The findings show how separately scoped credentials and infrastructure weaknesses can combine into a serious compromise when services place broader trust in one another than intended, with the financial impact continuing after the intruder has been removed.
