Railway says stolen credentials fueled about $740,000 in fraudulent AI usage

Attackers exploited two infrastructure flaws to steal customer credentials, according to Railway’s incident report. The company says it’s working with AI providers to reimburse roughly $740,000 in unauthorized usage and will cover charges providers won’t refund. Railway says it removed the attackers on October 21 and fixed all exploited vulnerabilities. The 100,000-workspace figure is its maximum potential exposure estimate, not a confirmed theft count.