Security · High impactFan score 67 · Tier A5 sources

Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges

The Hacker News · 3h ago

The Brief · written from 5 sources

Attackers exploited vulnerabilities in Railway's infrastructure in an attack on October 21 and stole customer authentication secrets and AI provider keys.
The stolen AI provider keys were used for an estimated $740,000 in unauthorized AI usage charges.
Railway says up to 100,000 workspaces could have exposed credentials, and it has promised to pay the charges itself if an AI provider will not refund them.

Why it matters

Secrets stored on Railway, especially AI provider keys, may have been exposed and abused, so developers should check their AI usage and harden their CI/CD and OIDC setups.

Who’s affected

Railway customers who stored AI provider keys or authentication secrets on the platform
Teams running CI/CD pipelines that use OIDC trust with cloud providers

What to do

Review build access in CI/CD pipelines
Tighten OIDC trust configuration
Consider using Harden-Runner to observe and restrict CI/CD runtime activity

#railway
#security-breach
#ai-api-keys
#cloud-hosting
#ci-cd

AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund…

Read the full story at thehackernews.com ↗