Hackers stole AI credentials to get $740,000 in free compute; Railway picked up the bill

Summary

Attackers breached cloud host Railway over a roughly 26-hour period starting October 20, chaining an unknown build-infrastructure flaw and a misconfigured trust relationship to decrypt about 100,000 customer environment variables (at most 1.85% of workspaces). They ran up about $740,000 in fraudulent AI usage charges using stolen AI provider keys, which were then resold for model distillation.

Mitigation

Railway advised users to revoke and reapply sensitive environment variables stored on Railway prior to October 21, remove public network access to databases, rotate sensitive variables and keys, check GitHub account audit logs and app access, and check registry audit logs such as Dockerhub. Railway shut down compromised internal tooling, rolled all keys, moved to a new generation of infrastructure, rebuilt its infrastructure tooling, and added functionality to mass revoke app permissions.

Related items

• InfoEndor Labs + OpenAI: Strengthening the Defense Factory With Accelerated Remediation | Endor LabsSame vendor · Endor Labs Blog
• LowAI chatbots are recommending fake retail websites, study findsSame vendor · The Verge (AI)
• InfoSecuring Frontier AI: ReversingLabs Is Part of Anthropic’s Expanded Cyber Verification ProgramSame vendor · ReversingLabs Blog
• InfoImproving Fuzzy Robustness in LLM Safety with Automated Red TeamingSame vendor · OpenAI Alignment Research Blog
• InfoSupporting research on AI and children’s safetySame vendor · OpenAI Blog