Bulletin: Compensation for unauthorized AI usage

Railway will reimburse customers for unauthorized AI token spend from an October 21 cyber attack that cost them at least ~$740K in AI tokens, paying out of its own funds when AI providers decline to refund. The cloud platform said unauthorized usage is covered on any AI provider key stored in Railway and compromised between 13:50 UTC on 10/20 and 9:25 UTC on 10/21, with claims due by Wednesday 11/18/2026 and reviewed within 15 business days. Railway is funding claims from its own funds while seeking insurance reimbursement, and Anthropic-key spend is covered by Railway while the company finalizes that process.

Bulletin: Compensation for unauthorized AI usage On October 21, Railway suffered a sophisticated cyber attack that resulted in a security incident with our customers losing at least ~$740K in AI tokens. Yesterday we published the full report https://blog.railway.com/p/incident-report-october-security-incident which details the attack in great detail. In this bulletin, we provide an update on the most common question we’re receiving, which is how to get compensated for any unauthorized token spend lost due to the security incident. Policy Simply put, we will attempt to help you get compensated by the AI provider for unauthorized usage on a key exposed in this incident, and if the AI provider will not refund, we will pay for it. What’s covered Unauthorized usage on any AI provider key stored in Railway and compromised from 13:50 UTC on 10/20 until the attacker was expelled on 10/21 at 9:25 UTC. This applies to every provider, including ones not listed below. How to claim There are a few steps: 1. Fill out the claim form https://docs.google.com/forms/d/e/1FAIpQLScoZrMclYiCD0mGxQ0Gf8spo-Brqn8nT6Vu7Ye9mRwQrCTz A/viewform . You’ll need the provider, the date range, and an invoice or usage report. 2. If your provider has its own refund process OpenAI, AWS Bedrock, and Google Gemini , start that too and add the CaseID to your claim 3. We will do our best to review all claims with 15 business days Please submit claims by Weds 11/18/2026, though we will do our best to honor claims submitted after that. Status | Provider | Policy | Action | |---|---|---| | AWS Bedrock | AWS refunds under its fraud policy | Contact AWS support link to AWS guide https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-aws-access | | Google Gemini | Google refunds under its fraud policy | Contact Google support link to GCP guide https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-gcp-access | | OpenAI | Reviewed case by case with us | Open an OpenAI support case link https://openai.com/form/appeal/ and send us the case ID | | OpenRouter | OpenRouter refunds under goodwill agreement | Submit through Railway | | SpaceXSI | Reviewed case by case with us | Submit through Railway | | Anthropic | Railway covers costs while we finalize the process | Submit through Railway | | Anyone else | Railway covers unrefunded spend | Submit through Railway | How we’re paying for it We’re paying claims from Railway’s own funds now, though behind the scenes we’re seeking insurance reimbursement for valid claims where providers are not covering. We’ll update this post as provider policies change. Please visit Central Station https://station.railway.com/new to ask any questions or provide feedback to our team. We’re sorry this happened and we will continue to do everything we can to make our customers whole again.