Railway Reports $740,000 in Unauthorized AI Usage Charges Due to Stolen Customer API Keys

Platform-as-a-service provider Railway has disclosed that stolen customer AI provider keys, compromised in an October breach, led to an estimated $740,000 in unauthorized spending. The attacker decrypted environment variables in approximately 1.85% of workspaces (around 100,000), specifically targeting AI provider keys. Railway has committed to covering these charges if AI providers do not issue refunds, and has reset linked-account tokens for affected users.