The cloud hosting platform has published a set of instructions for users to seek compensation for unauthorized token spend on AI providers following a security breach. Railway said in a company update it will cover fraudulent charges that AI service providers refuse to refund, providing a path for affected customers to recover their losses.
The October 21 breach occurred when an attacker exploited a bug in the platform’s build isolation to access a database of secrets, potentially impacting about 100,000 workspaces. Railway estimates that the theft of AI API keys resulted in approximately $740,000 in unauthorized spending, while additional reports indicate a separate loss of about $371,000 in cryptocurrency keys.
