Hackers stole AI credentials to get $740,000 in free compute; Railway picked up the bill
As AI model training and distillation increase, AI tokens are becoming a piping hot currency for threat actors. Cloud hosting provider Railway found out the hard way; it has confirmed a near 26-hour battle against attackers targeting AI provider credentials to sell to AI ‘transfer stations’ for use in model distillation. The crooks generated about $740,000 in fraudulent AI usage charges using the stolen credentials and potentially had access to up to 100,000 workspace credentials. Railway said the attacker’s database searches looked for AI provider keys by name before anything else; some queries also targeted cloud, database, and payment service credentials. The company disclosed the incident on October 22 , and posted a follow-up report this week. Because of the ongoing investigation, it is not able to share the specific details and scale of the exploits, but advised users to revoke and reapply sensitive environmental variables stored on Railway prior to October 21. “AI credentials ar