Railway PaaS Reports Theft of Customer AI API Keys Resulting in $740K Unauthorized Usage

Qué ocurrió

In October 2026 Railway’s secret‑management subsystem was breached, exposing customer‑supplied AI API keys. Attackers used those keys to generate massive AI request volumes, incurring $740,000 in usage fees before Railway detected the anomaly and began remediation.

Por qué es importante para la confianza y el cumplimiento

• The incident tests the control objective of protecting and managing cryptographic secrets, a requirement that maps to multiple frameworks and demonstrates the need for auditable secret‑management processes.
• Validate that secret‑storage processes enforce least‑privilege access and are continuously monitored.
• Collect evidence of key rotation and usage‑anomaly alerts to support audit readiness.

Who is affected

Recommended actions

1. Rotate all compromised API keys and adopt short‑lived tokens.
2. Enable real‑time usage anomaly detection on AI service accounts.
3. Harden secret‑management controls: encrypt at rest, enforce zero‑trust access, and log all retrieval events.