According to Railway, the attack began on October 20: the attackers exploited an unknown flaw in its build infrastructure to escape filesystem isolation and obtain an internal credential, read its internal source code, then abused a misconfigured trust relationship to decrypt customer environment variables. The company describes a roughly 26-hour contest against attackers using AI agents; they were removed on October 21.
The figure of about 100,000 workspaces (1.85%) is an upper bound, not a confirmed count. Linked-account tokens for 1,852 users were also exposed, including GitHub OAuth tokens and AI agent keys; all were reset and the users notified. The company says it found no evidence that customer databases were accessed or code repositories downloaded.
Railway is working with AI providers on refunds and will cover charges a provider declines to refund. According to The Hacker News, AWS Bedrock and Google Gemini refunds have begun, OpenAI reviews claims case by case, and Railway is covering OpenRouter and Anthropic costs for now.
What to do: Railway customers should rotate every secret stored as an environment variable, especially AI provider API keys, and report suspicious charges. The company links the incident to a wave of attacks on AI development platforms that Wiz has dubbed "Black October."
