Attackers who broke into app hosting platform Railway in October ran up an estimated US$740,000 (about A$1.07 million) in unauthorised usage on AI provider keys stolen from its customers, the company said in an incident post-mortem reported by iTnews.
What happened
According to Railway’s report:
- The intrusion began on 20 October, when the attacker used a previously unknown flaw in Railway’s build infrastructure to read files on a host machine and take a build credential.
- An internal workflow system wrongly trusted that credential, exposing 353 build histories and a copy of Railway’s source code.
- Using the code, the attacker found a misconfigured identity binding and reached a machine that could decrypt customer variables.
- Railway says it evicted the intruder on 21 October.
The attacker decrypted stored environment variables for at most 1.85 per cent of workspaces, or about 100,000, and took linked-account tokens, including GitHub OAuth tokens, for 1852 users. Railway says database logs show queries that picked out variables named like AI provider keys.
Who pays
Refunds depend on the provider. Railway says AWS and Google have begun refunds, OpenAI and SpaceXSI are reviewing claims case by case, OpenRouter is applying its no-refund terms, and Anthropic was still in discussions. Railway says it will cover losses that providers don’t.
Railway believes the keys may have been resold for model distillation, but says it hasn’t established that.
A wider pattern
The breach fits a trend security researchers call “LLMjacking”: stealing access to AI models and leaving the victim with the bill. Wiz has said at least nine AI developer platforms disclosed incidents in October, a list iTnews reports has since grown to 15.
