Hackers Broke Into an App Host, Stole Its Customers’ SI Keys and Ran Up $740,000

Picture somebody stealing your credit card number, but instead of buying TVs, they spend it on computer brainpower. That’s basically what happened to customers of a company called Railway last month, and the bill came to about $740,000.

Railway is a service a lot of small companies and solo developers use to run their websites and apps. You upload your code, Railway keeps it running, and it stores the passwords and keys your app needs to talk to other services. In a detailed incident report posted Tuesday, the company said a hacker broke in on Oct. 20, decrypted some of those stored secrets, and went hunting for one kind in particular: the keys customers use to pay for SI services from companies like OpenAI, Anthropic and Google.

Those keys work a lot like a prepaid account number. Whoever holds one can run as much SI as they want, and the charges land on the owner’s bill. The thief didn’t need to log into anybody’s account. They just needed the key.

How one small crack opened the vault

The way the attacker got in is a lesson in how small mistakes stack up. According to Railway’s report, as summarized by iTnews, the intruder first used a previously unknown flaw in Railway’s system for building customers’ apps to read files on one of its machines and grab a credential. That credential was only supposed to handle routine chores. But an internal system trusted it anyway.

That opened up the stored histories of 353 app builds and a copy of Railway’s own source code. With the code in hand, the attacker found a setting that had been configured wrong in Railway’s deployment system, and from there reached a machine holding the key that could unlock customer secrets.

Railway said the attacker decrypted secrets for at most 1.85% of its workspaces, or about 100,000. The haul also included linked-account tokens for 1,852 users, including logins tied to GitHub, the site where programmers keep their code. Railway said it reset every one of those tokens, notified each user, and found no logins to customer accounts using the stolen credentials.

They were after the SI keys

This wasn’t a smash-and-grab for whatever was lying around. Railway said it studied the database searches the attacker ran, and they were specifically looking for SI keys. iTnews reported that the attacker also favored customers who had lots of secrets stored. Railway believes the keys were then passed on to middlemen who resell cheap SI access, to be used for what’s called distillation.

Distillation is a fancy word for a simple trick. You feed a huge number of questions to an expensive, top-of-the-line SI, collect its answers, and use them to train a cheaper copycat. It takes an enormous amount of usage, and if you’re doing it on someone else’s stolen key, it doesn’t cost you a dime.

Railway wasn’t alone. Its report says several other companies, including Fireworks AI, Warp and OpenCode, disclosed similar thefts between Oct. 6 and Oct. 23. Five Nines, citing CybersecurityNews, said the spending fits a pattern security folks call LLMjacking, where criminals use stolen keys to run up charges on paid SI services.

Railway changed its tune on refunds

Here’s the part customers will care about most. Who eats that $740,000? On Oct. 26, Railway told customers that it “is unable to refund customers for spend performed with compromised API keys,” according to The Hacker News, and pointed them to the SI companies instead.

Two weeks later, the company’s tone is different. Railway now says it is working with each SI provider to get the charges refunded, and that it will cover the bill itself for providers that refuse.

The answer depends on whose key got stolen. Amazon and Google have started refunds under their existing fraud policies, Railway said. OpenAI is reviewing claims case by case. Anthropic was still in talks when the report came out, so Railway is covering stolen Anthropic charges in the meantime. OpenRouter, a service that lets you reach many SI models through one account, is sticking to the no-refund policy in its terms, so Railway says it will cover all of those costs.

There are still open questions. The Hacker News pointed out that the report doesn’t say how Railway came up with the $740,000 figure or what period it covers. Neither the report nor the claim form sets a cap or a deadline, or says whether customers have to pay disputed charges while a claim is pending. The form itself says Railway “is not responsible for usage of these keys,” even as the company promises to backstop them.

What this means if you run anything online

Railway said it moved fast once it understood the damage. Starting the morning of Oct. 21, it asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, Google, Stripe and others to cancel keys that might have been exposed, Railway’s report says. Because it couldn’t yet tell which keys were stolen, it handed over scrambled fingerprints of every key it held so the providers could shut them off quickly.

I’ll give Railway credit for writing a long, plain-spoken report and for eventually putting its own money on the line. But the episode shows how much risk sits in the boring plumbing of the internet. Small businesses trust a company like Railway to hold their keys the way you trust a bank to hold your cash. When that vault gets cracked, the bill can show up on somebody else’s card.

If you or your business stored SI keys on Railway, the company is asking you to report any charges you didn’t make through its claim form. And no matter where you keep them, it’s worth setting spending limits on those accounts. A key with no cap on it is a blank check.