Railway incident report: attackers hunted AI provider credentials in the October breach

Railway published its final incident report on November 10, 2026, covering the October 2026 attack it first disclosed on October 21, in which the attacker hunted AI provider credentials stored in customer environment variables. The attacker probed Railway's build infrastructure from October 18, first exploited it at 07:28 UTC on October 20, chained exploits to move laterally across systems, and was fully evicted at 09:24 UTC on October 21. Railway halted builds twice, rotated internal credentials, invalidated every user session and token, and restored builds for all plans by October 22 after hardening the infrastructure.

The report puts the customer impact at an upper bound: decrypted environment variables for at most 1.85% of workspaces, about 100,000, with the decryption of per-environment keys running from 04:42 to 07:14 UTC on October 21. The attacker also read the stored histories of 353 builds, sealed variables included, and the decrypted data included linked-account tokens, BYOK agent keys and GitHub OAuth tokens, for 1,852 users; Railway reset every one of those tokens and says it identified no logins to Railway accounts using credentials taken in the incident, and that the customer database was not accessed.

Railway's forensic investigation concluded the attacker was specifically targeting AI provider credentials to sell to distributed transfer stations for use in distillation, using safeguard-stripped models with a harness similar to ARTEX, according to Wiz. Unauthorized spend on the stolen keys was estimated at about $740,000; Railway is coordinating refunds with providers and will cover the losses itself where a provider will not. Railway says every attack vector used has been remediated: builds now run on dedicated ephemeral virtual machines, the CI pipeline was rebuilt, and secret storage and decryption were hardened. Its specialist forensics firm's investigation is still ongoing, and indicators of compromise will be shared publicly once law enforcement signs off.