Railway published findings from its October security incident, identifying approximately $740,000 in unauthorized AI usage. Its investigation traces access from a build environment into internal systems and puts potential environment-variable exposure at up to 100,000 workspaces. The company reset linked-account tokens for 1,852 users and described infrastructure and credential changes.
Railway, a software deployment platform, published its final account of an October security incident on November 10. Its investigation identified approximately $740,000 in unauthorized AI usage. The company places potential exposure of encrypted environment variables at roughly 100,000 workspaces, or 1.85 per cent of the total. That figure is an upper bound, rather than a confirmed count of workspaces whose data was stolen.[1], [2]
Investigators traced a partial escape from a build filesystem to an exposed credential. Its acceptance by Temporal, an internal workflow service, enabled access to 353 build histories. An internal repository, misconfigured authorization and a machine credential then opened broader access. Access to the key-management service allowed potential decryption of environment variables. Railway says it found no evidence of downloaded customer repositories or access to customer databases.[1]
Railway reset linked-account tokens for 1,852 users. It says provider refunds or its own coverage will protect customers from unauthorized charges. Remediation includes fresh virtual machines for builds, narrower image-push permissions, rotated credentials and centralized auditing of secret decryption. Providers were contacted before users. Railway says replacement keys could remain exposed while the attacker retained access.[1]
