Railway estimates stolen credentials generated about $740,000 in unauthorized spending following its October breach, according to a postmortem published November 10.
The company describes a chain of failures: an escape from build filesystem isolation exposed an internal credential; access to build histories and Railway’s codebase followed. A misconfigured OpenID Connect trust relationship then provided cloud access, leading to credentials that could retrieve and decrypt customer secrets.
Railway says at most 1.85% of workspaces—roughly 100,000—could have had environment variables decrypted. This is an upper bound, not a confirmed victim count. Decrypted linked-account tokens also affected 1,852 users.
The attacker lost access on October 21, Railway says. It has since introduced dedicated build virtual machines, narrowed credential permissions and restricted secret decryption.
Customers should review provider billing and outstanding credential rotations. Railway asks customers to report unauthorized charges and says it will cover token losses providers decline to refund.
