On October 21, Railway suffered a sophisticated cyber attack that resulted in a security incident with our customers losing at least ~$740K in AI tokens.
Yesterday we published the full report which details the attack in great detail. In this bulletin, we provide an update on the most common question we’re receiving, which is how to get compensated for any unauthorized token spend lost due to the security incident.
Policy #
Simply put, we will attempt to help you get compensated by the AI provider for unauthorized usage on a key exposed in this incident, and if the AI provider will not refund, we will pay for it.
What’s covered #
Unauthorized usage on any AI provider key stored in Railway and compromised from 13:50 UTC on 10/20 until the attacker was expelled on 10/21 at 9:25 UTC. This applies to every provider, including ones not listed below.
How to claim #
There are a few steps:
- Fill out the claim form . You’ll need the provider, the date range, and an invoice or usage report.
- If your provider has its own refund process (OpenAI, AWS Bedrock, and Google Gemini), start that too and add the CaseID to your claim
- We will do our best to review all claims with 15 business days
Please submit claims by Weds 11/18/2026, though we will do our best to honor claims submitted after that.
Status #
| Provider | Policy | Action |
|---|---|---|
| AWS Bedrock | AWS refunds under its fraud policy | Contact AWS support ( [link to AWS guide](https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-aws-access) ) |
| Google Gemini | Google refunds under its fraud policy | Contact Google support ( link to GCP guide ) | | OpenAI | Reviewed case by case with us | Open an OpenAI support case ( link ) and send us the case ID | | OpenRouter | OpenRouter refunds under goodwill agreement | Submit through Railway | | SpaceXSI | Reviewed case by case with us | Submit through Railway | | Anthropic | Railway covers costs while we finalize the process | Submit through Railway | | Anyone else | Railway covers unrefunded spend | Submit through Railway |
How we’re paying for it #
We’re paying claims from Railway’s own funds now, though behind the scenes we’re seeking insurance reimbursement for valid claims where providers are not covering.
We’ll update this post as provider policies change.
Please visit Central Station to ask any questions or provide feedback to our team.
We’re sorry this happened and we will continue to do everything we can to make our customers whole again.