What's new. Railway disclosed the October 21 attack the next day and told customers to rotate secrets. Its Nov 10 incident report adds the first real numbers: decrypted variables for at most 1.85% of workspaces (about 100,000), which Railway calls a maximum rather than a confirmed count, and linked-account tokens (bring-your-own AI agent keys and GitHub OAuth tokens) for 1,852 users. Railway says it reset every one of those tokens and found no logins to Railway accounts with them.
How they got in. As BleepingComputer and Cybersecurity News summarize the report, the path ran through Railway's shared build machines and an incorrect OpenID Connect (OIDC) trust setting, which is how cloud services decide which outside systems may borrow a login. That exposed a short-lived cloud credential, which led to internal credentials, an SSH key and a machine with access to the production database. The attacker then used Railway's own key management service to decrypt values. That is stolen access, not broken encryption.
What they wanted. Railway says the database queries hunted for AI provider key names, and it believes the keys were resold for model distillation. Spend on the stolen keys reached about $740,000, a scheme known as LLMjacking. AWS Bedrock and Google Gemini are refunding under their fraud policies, OpenAI is reviewing case by case, and Railway says it will cover Anthropic costs while talks continue and all OpenRouter costs. BleepingComputer ties this to the wave of attacks on AI developer platforms that Wiz calls "Black October."
Why this matters to an enterprise. Any platform that stores your environment variables is holding your AI bill. If your teams deploy on Railway, rotate every secret stored there before Oct 21, check AI provider usage since Oct 20, and put spend caps and alerts on every AI key.