Railway, the platform-as-a-service company that stores customers' environment variables and deploys their apps, said Nov. 10 that AI provider keys stolen in its October breach were used to run up an estimated $740,000 in unauthorized charges. In a detailed incident report, the company said it will cover those losses when an AI vendor will not refund them — reversing the position it published on Oct. 26.
That earlier update was blunt: "Railway is unable to refund customers for spend performed with compromised API keys." Customers were told to contact the AI providers themselves and then file a support request so Railway could escalate the claim. On Nov. 10, the company wrote that it is "working with the providers to refund it, as well as backstopping it from our own balances for those unwilling to do so."
The $740,000 figure is Railway's estimate. The Nov. 10 report does not say how the number was calculated, which providers it includes, or over what period the spend accrued. Railway also has not published a cap or a deadline for claims, or said whether customers must pay disputed invoices while a claim is pending.
The attacker first escaped a flaw in Railway's multi-tenant build infrastructure on Oct. 20, then used a misconfigured cloud login and stolen credentials to reach a machine that could decrypt customer environment variables, the company said. Database logs showed the attacker searching for AI provider key names. Railway says the attacker had no further access to customer data after 09:25 UTC on Oct. 21, or 5:25 a.m. Eastern.
How many customers were actually hit is still a layered number, not a single headcount. Railway says at most 1.85% of workspaces — about 100,000 — could have had any environment variables decrypted, and it calls that an upper bound because its logs identify environments, not individual variables. Separately, it says the attacker decrypted linked-account tokens, including bring-your-own-key agent keys and GitHub OAuth tokens, for 1,852 users. Railway says it reset those tokens, notified each of those users, and found no logins to Railway accounts with the stolen credentials. It has not published a confirmed count of workspaces whose AI keys were both stolen and then used to generate the estimated $740,000 in charges.
Who pays now depends on the vendor — and, in several cases, on Railway's account of a working arrangement rather than on a public, automatic refund guarantee.
Railway said AWS Bedrock and Google Gemini already have refund policies that "cover fraud," and that both companies' account teams "have initiated refunds for customers." Those characterizations are Railway's. Amazon Web Services' Customer Agreement says customers "are responsible for all activities that occur under your account, regardless of whether the activities are authorized by you," and that AWS is "not responsible for unauthorized access to your account." A public AWS document promising an automatic refund for fraudulent Bedrock or API usage was not found. Google Cloud's billing documentation tells customers who suspect a compromise to contact Cloud Customer Care "to report the compromise and discuss potential billing adjustments," and adds that "Google Cloud reviews such cases on an individual basis."
OpenAI and SpaceXSI are reviewing refunds case by case, Railway said. For OpenAI, customers are told to file the company's "Submit an Appeal or Report Unauthorized Activity" form, mention the Railway incident, and pass the case ID to Railway. OpenAI's published terms say fees are "non-refundable except as required by law" or as otherwise permitted in the agreement. SpaceXSI is the legal name on xAI's consumer terms of service, which say payments already made "are non-refundable, except where required by law." Railway says customers should send SpaceXSI claims to Railway support, and that the two companies have a "shared bridge" to review them.
Anthropic's refund path is still unsettled. "As of writing, we are in active discussions with their customer team to get next steps for our joint customers," Railway said. "In the interim, we will be covering Anthropic breached key costs ourselves."
OpenRouter is the clear exception among the providers Railway named. Railway said the company "has decided to enforce their no-refund policy as per their Terms of Service," so Railway "will be covering all costs associated with this breach in relation to OpenRouter." OpenRouter's terms make customers "responsible for all activity and charges under its account or API Credentials, whether or not authorized by you, except to the extent caused directly by OpenRouter's breach of these Terms." Unused credits can be refunded only if the request comes within 24 hours of purchase; after that, they "become non-refundable." That language does not create a refund for usage already burned on a stolen key.
Customers are asked to report unauthorized charges through Railway's "Report of API Provider Token Abuse" form. The form still says, "Railway is not responsible for usage of these keys but is actively investigating the theft and misuse and working with the AI Providers." That disclaimer has not been updated to match the Nov. 10 promise to cover unpaid losses. It does not set a claims deadline or say what happens if a provider bill comes due while a report is outstanding.
Railway believes the keys were stolen to be sold. "Based on our forensic investigation, we believe the attacker was specifically targeting AI provider credentials, that they could sell to distributed transfer stations for use in distillation," the company wrote. That is Railway's conclusion from its own investigation, not an independently confirmed fact. The company also said customer-shared logs were "consistent with compromised credentials being distributed through services that relay or resell access to AI providers," and that it has not established whether the original attacker ran those services or sold the keys to others. Wiz's "Black October" research, which Railway cites for context, documents a broader pattern of stolen AI credentials being resold; Railway notes that the Wiz work "does not independently attribute the Railway incident."
The Railway breach sits in a cluster of October incidents at platforms that hold AI keys. OpenCode said on Oct. 17 that a breach of a legacy system behind its hosted Console, "related to a large scale distillation attack," affected 1.4% of Console users who had linked outside providers. Warp founder and CEO Zach Lloyd said on Oct. 26 that the company had detected what it believed was "an active and narrow-banded exploitation of a vendor in Warp's infrastructure" on Oct. 23, affecting an upper bound of "roughly 1%" of users, with agent traces and telemetry potentially exposed; Warp has not said whether API keys were in that set. Fireworks AI, which first disclosed unauthorized access to some customer evaluation-job secrets in early October, later said a second incident reached billing data and, for some accounts, unfinished model weights — a wider impact than its first bulletin described (https://sayer.news/article/fireworks-ai-says-a-second-october-breach-reached-billing-data-and-some-unfinished-4977d9bd).
Stolen inference keys are valuable because they can be spent immediately, on someone else's bill. Railway has now said it will put itself between its customers and that bill. What it has not yet said is how the $740,000 was counted, how long customers have to claim, or who pays first.