An attacker breached the cloud infrastructure platform Railway in October, using a failure in build isolation to access source code and sensitive customer credentials. The company said the security lapse potentially impacted as many as 100,000 workspaces, resulting in approximately $740,000 in fraudulent charges on stolen AI provider keys.
Railway believes the attacker targeted the AI keys for resale and accessed them through misconfigured permissions. In addition to the AI-related theft, the breach reportedly compromised cryptocurrency keys, leading to an estimated $371,000 in further unauthorized losses.
