Railway Hit by Cyberattack: $740,000 in Illegal AI Expenses

How the Breach Occurred

Cloud hosting service Railway has published a report detailing a major cyberattack that caused significant financial damage to both the company and its users. The incident, which lasted 26 hours, involved hackers illegally exploiting resources from artificial intelligence services. Using stolen keys, the attackers reportedly consumed $740,000 worth of AI services.

Railway, which enables developers to deploy and manage applications rapidly, stated that the attackers utilized a "zero-day" vulnerability—a security flaw previously unknown at the time. Hackers managed to break through file system isolation and access data stored on virtual machines.

This information allowed the attackers to infiltrate Railway’s internal systems, including the task management platform Temporal. Ultimately, they gained access to the client database keys, enabling them to decrypt confidential environment variables where API keys are frequently stored.

Exploiting Stolen Resources

The primary target for the hackers was AI service API keys. By leveraging these stolen credentials, they executed massive requests to AI models. Experts suggest these resources were used for "model distillation," a process where a smaller AI model is trained to mimic the responses of a larger, more powerful one. This technique is often used to "download" the capabilities of models by generating large volumes of data.

The company estimates that the attackers may have had access to data belonging to up to 100,000 users. The attack began on October 20 and continued for 26 hours. Railway engineers worked continuously to defend the system in what the company described as a "race of agent speeds," where attackers utilized automated systems.

Steps Taken by Railway

Railway’s infrastructure is now fully secured. The company has patched the vulnerabilities, updated its systems, and rotated all compromised keys. Most importantly for its users, Railway has pledged to fully cover the financial losses incurred through their interactions with AI providers.

This incident underscores the critical importance of cloud service security. For developers using such platforms, it serves as a reminder that the storage and monitoring of API keys are essential. For users globally who rely on similar services for hosting projects, it is vital to track platform updates and implement additional security layers, such as two-factor authentication and strict access controls.