I was affected by the recent Railway security breach. I have a small personal calorie-tracking app hosted on Railway that uses Google's Gemini 2.5 API for food photo scans.

Last night around 2 AM, someone used my Google AI API key and drained all $20 of my prepaid credits. I confirmed the unauthorized usage in my Google Cloud logs. Luckily, I only had $20 loaded.

I've reached out to Railway support to see if they'd offer any credit or compensation as a goodwill gesture.

Has anyone else experienced unauthorized API usage from this breach? If so, have you had any luck getting reimbursed or receiving credits from Railway?