Railway breach leads to $740,000 in fraudulent AI charges

Attackers exploited vulnerabilities in Railway's build infrastructure to extract customer authentication secrets and environment variables from up to 100,000 workspaces — credentials that should never be accessible outside their intended runtime context. The root failure was an unpatched or misconfigured build pipeline that allowed lateral movement from infrastructure to sensitive customer data. This matters because build systems are high-value targets: they touch source code, secrets, and deployment credentials simultaneously, making a single compromise catastrophic in scope. The $740,000 in fraudulent AI charges illustrates how stolen API keys and tokens can be monetized rapidly, long before victims detect the abuse.