Read more at:
The threat actors were “fully evicted” on October 21, but over the course of their time in the system, they obtained and decrypted a “subset” of customer variables, roughly 100,000, or “at most” 1.85% of workspaces. They also racked up $740,000 in fraudulent AI usage charges, with customers reporting their keys answered coding questions and performed training-data tasks they never ran. The company is working to reimburse customers, including for charges providers decline to refund.
The breach also exposed linked-account tokens belonging to more than 1,850 users, which included GitHub and OAuth tokens that Railway says it reset. The company worked quickly with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe, and others to revoke potentially compromised keys.
In the wake of the attack, customers have been advised to remove public network access to databases; rotate any sensitive variables and keys; check GitHub account audit logs and review all app access; and check audit logs within registries such as Dockerhub.
