๐ A Railway breach let attackers steal AI keys and run up about $740,000 in charges
App-hosting company Railway said in a November 10 incident report that attackers broke into its systems on October 20-21 and targeted customer AI-provider credentials. Forensic logs show that at most about 100,000 workspaces (1.85%) could have had environment variables decrypted, an upper bound, and that linked-account tokens for 1,852 users were exposed. Railway estimates unauthorized spend on the stolen keys at about $740,000 and says it is working with providers on refunds, covering costs itself when a vendor will not. It believes the keys were aimed at resale for model distillation, and says the attack fits a wider wave of AI-credential theft.
โญ AI API keys have become high-value loot: one stolen secret can burn a six-figure bill and feed someone else's training run.
#AI
App-hosting company Railway said in a November 10 incident report that attackers broke into its systems on October 20-21 and targeted customer AI-provider credentials. Forensic logs show that at most about 100,000 workspaces (1.85%) could have had environment variables decrypted, an upper bound, and that linked-account tokens for 1,852 users were exposed. Railway estimates unauthorized spend on the stolen keys at about $740,000 and says it is working with providers on refunds, covering costs itself when a vendor will not. It believes the keys were aimed at resale for model distillation, and says the attack fits a wider wave of AI-credential theft.
โญ AI API keys have become high-value loot: one stolen secret can burn a six-figure bill and feed someone else's training run.
#AI
