Cloud host Railway details intrusion: secrets of up to 100,000 workspaces exposed and stolen AI credentials used for ~$740,000

BleepingComputer reports that cloud hosting provider Railway published an incident report confirming attackers obtained its internal source code and decrypted environment variables for at most 1.85% of workspaces, about 100,000 ^[1]. On Oct 20 the attackers exploited an unknown flaw in its build infrastructure to escape filesystem isolation and get an internal credential, then abused a misconfigured trust relationship to obtain credentials for decrypting customer environment variables ^[1]. The stolen credentials generated about $740,000 in unauthorized AI usage, and linked-account tokens of 1,852 users, including GitHub OAuth tokens, were exposed and have been reset ^[1].

Industries mainly affected: Technology

The stolen credentials generated about $740,000 in unauthorized AI usage, and linked-account tokens of 1,852 users, including GitHub OAuth tokens, were exposed and have been reset ^[1]