Railway, the cloud platform that warned all users to rotate their secrets in late October, published its full incident report on November 10, and it puts numbers on the damage. The company says the attacker was able to decrypt environment variables for at most 1.85% of workspaces, about 100,000. That figure is an upper bound: Railway’s logs identify a subset of environments rather than individual variables. The attacker also read the stored histories of 353 builds, and the data it decrypted included linked-account tokens (GitHub OAuth tokens and bring-your-own-key agent keys) for 1,852 users. Railway says it reset every one of those tokens, notified each user, and found no logins to Railway accounts using credentials taken in the incident.
According to the report, the attacker began probing build infrastructure on October 20 and exploited a previously unknown vulnerability to escape the isolation between builds that shared a virtual machine, then used a second weakness to move further. BleepingComputer describes the second as an improperly configured trust relationship. Railway says its forensics show the attacker was searching specifically for AI provider credentials, which it believes were meant for resale or use in model distillation, and that unauthorized spend on the stolen keys reached an estimated $740,000. The company describes a roughly day-long contest in which it hardened routes in parallel against an attacker using a harness “similar to ARTEX, according to Wiz”. Wiz groups the incident with a wider wave it calls “Black October” against AI developer platforms; Railway says that research gives context but does not attribute its incident to one operator. The attacker was fully evicted by 09:24 UTC on October 21, and Railway says every exploited weakness is now closed. BleepingComputer reports Railway found no evidence that customer Git repositories were downloaded or customer databases accessed.
This follows our earlier coverage of Railway’s first warning to rotate secrets, which was written before these figures were known.
How to check if you’re affected
Affected products are Railway workspaces that stored environment variables, with up to 1.85% of workspaces potentially affected; Railway says it emailed customers at high risk based on its forensics. If you have not already done so, the earlier advice still stands: rotate secrets stored in Railway and rotate third-party keys with the provider that issued them (our suggestion: start with AI provider keys, which Railway says the attacker targeted).
If you saw AI charges you did not make, Railway asks you to report them using the form in its report, and says it is coordinating refunds with providers. It lists these provider policies at the time of writing:
- AWS Bedrock and Google Gemini: existing fraud refund policies apply, and their account teams have started refunds for customers.
- OpenAI: open a support request and pass the Case ID to Railway support; refunds are reviewed case by case.
- SpaceXSI: contact Railway support with your claim; refunds are reviewed case by case.
- Anthropic: Railway is in discussions and is covering Anthropic breached-key costs itself in the meantime.
- OpenRouter: it enforces a no-refund policy, and Railway says it will cover all OpenRouter-related costs from this breach.
Sources
- Railway: Incident Report, October 21st Security Attack
- BleepingComputer: Railway breach leads to $740,000 in fraudulent AI charges
- Wiz: Black October for AI developer platforms (linked from Railway’s report and BleepingComputer; not read directly)