Stolen Customer AI Keys Lead to $740,000 in Unauthorized Charges at Railway

A cyberattack on Railway, a cloud hosting provider, in October exposed customer credentials that resulted in approximately $740,000 worth of unauthorized artificial intelligence (AI) usage charges. In addition to stealing customer secrets, hackers also acquired credentials to AI service providers, which were used to generate fraudulent usage across several AI platforms with the stolen keys.

Railway revealed in a report published on November 11 that attackers gained access to decrypted environment variables belonging to a maximum of 1.85% of its workspaces, or approximately 100,000 workspaces. Nevertheless, the company clarified that this represents the potential scope of exposure rather than the number of compromised credentials confirmed by the company. 
A security incident was first reported by the railroad on October 22, and customers were advised to rotate sensitive credentials stored on the railroad's platform. Further investigation revealed that the attackers had also accessed internal source code, build histories, and linked account tokens for 1,852 users as well. In addition to resettling the affected tokens, including GitHub OAuth credentials as well as Bring Your Own Key (BYOK) agent keys, Railway also notified the affected users. 
It has been determined that the attackers searched Railway's production database for environment variables related to artificial intelligence providers. There were also queries targeting credentials connected to cloud services, databases, and payment platforms. Following the theft of the AI keys, external AI services were accessed and unauthorized charges were generated valued at $740,000. The financial impact varies according to the refund policies of the individual AI providers. 
Amazon Bedrock and Google Gemini have begun processing refunds under their existing fraud policies, whereas OpenAI and SpaceXSI are evaluating each claim individually. As of the date Railway published its report, discussions with Anthropic were still ongoing. OpenRouter maintains a no-refund policy, and will not reimburse the affected usage. Railway has pledged to cover breach-related charges that providers do not refund.
In its investigation, Railway reported that it found no evidence that attackers had accessed customer databases or downloaded customer Git repositories. However, Railway customers who rely on it to store sensitive application secrets were exposed to environment variables and linked account credentials, posing a substantial risk. 
Attackers Exploited Multiple Security Weaknesses to Reach Customer Secrets
Upon investigation, Railway determined that there was not a single vulnerability involved in the intrusion, but rather multiple stages. The attack began on October 20, when a threat actor partially bypassed filesystem isolation on a host virtual machine by exploiting an undisclosed flaw in the platform's multi-tenant build system. 
The credential provided was originally designed to allow build servers to push container images on the platform.
By using this credential, the attackers were able to gain access to Railway's internal Temporal workflow system, which mistakenly accepted it as a trusted client. These data included cached copies of Railway's internal source code repository, as well as stored histories of 353 builds, including secrets used in those processes. 
Another vulnerability in Railway's cloud deployment infrastructure was identified through analysis of the source code.
Following the exploit of a misconfigured OpenID Connect (OIDC) identity binding, the attackers obtained temporary cloud credentials. The credentials enabled access to additional internal resources, including a computer containing the decryption credentials necessary for accessing the environment variables of customers. 
On October 21, 04:07 and 07:15 UTC, the attackers accessed the production database for encrypted variables, prioritizing entries related to artificial intelligence service providers.
It has been confirmed by Railway that the credentials were decrypted in two separate periods before the intruders were entirely eliminated at 09:24 UTC on October 21. 
Railway engineers worked simultaneously to contain the intrusion as attackers used AI-powered agents to identify and exploit vulnerabilities during a prolonged security battle, according to the company. The attackers reportedly employed modified artificial intelligence models to assist with their operations that were devoid of safety restrictions. 
The railway industry strengthens its infrastructure following the breach
In invenstigation it was found that fRailway revised parts of its build infrastructure and closed the vulnerabilities involved. As a result, each build runs within its own, independent, short-lived virtual machine, with credentials restricted to pushing a specific image of a container. A logging system has also been implemented for every encryption and decryption operation to provide improved visibility into access to sensitive

Read the original article:

Stolen Customer AI Keys Lead to $740,000 in Unauthorized Charges at Railway