Railway said an October breach exposed customer-stored AI provider keys and led to an estimated $740,000 in unauthorized usage; it promised to cover those charges when providers do not refund them. It said attackers decrypted variables in at most 1.85% of workspaces, an upper-limit estimate, and found no stolen-credential logins or customer database access.