Cloud hosting firm Railway says recent breach leads to $740,000 in fraudulent AI charges
- Attackers exploited a zero-day in Railway’s build infrastructure to steal customer AI API keys and cloud credentials
- Stolen keys fueled roughly $740,000 in unauthorized AI usage, likely supporting large-scale model training and automation
- Railway spent 26 hours battling AI-assisted attackers before containing the intrusion and rotating credentials
US-based cloud hosting company Railway said threat actors abused a previously unknown vulnerability to break in, steal user credentials, and rake up hundreds of thousands of dollars in unauthorized AI usage.
The company managed to throw out the criminals and harden its infrastructure, but not before witnessing an epic 26-hour bot-versus-bot battle.
Railway gets attacked
At its core, Railway is a cloud hosting company, but one designed primarily for developers to build, deploy, and run applications without having to manage much of the underlying infrastructure.
Its key services include running websites and APIs, hosting databases and deploying PostgreSQL and MySQL, connecting GitHub repositories...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
