Railway, a cloud hosting provider, says an October breach allowed attackers to access authentication secrets tied to customer AI access. The company estimates the misuse resulted in about $740,000 in fraudulent or unauthorized AI charges.
Railway says the issue involved a security weakness in its infrastructure that enabled theft of customer authentication material, including AI-related keys. Sources describe the attackers using the compromised access to generate AI expenses, with Railway presenting the losses as estimated unauthorized usage. The company also says it will cover the charges in cases where an AI provider does not refund customers.
Outlets emphasise different parts of the same incident: one focuses on the pathway from a zero-day-style vulnerability to rapid cost accumulation, another frames the story around stolen customer AI keys, and a third adds scale by pointing to the number of workspaces whose credentials may have been exposed. Overall, the reported core facts—breach, stolen access, and the $740,000 estimate—are consistent.
