a day ago
Hello Railway team,
After your security incident disclosed on 21 October 2026, a third party used our Gemini API key, which was stored as an environment variable on Railway. Google's anomaly detection flagged the usage the same day: €133.12 observed against a predicted baseline of €0.02. Google declined our refund request, so we are left with €118.35 in fraudulent charges.
We have also lost about one day of developer time rotating every secret in our project, including database credentials, auth keys and deploy keys.
We are asking for:
- An account credit covering the €118.35 in fraudulent charges (invoice and Google anomaly report attached). We would appreciate any additional goodwill for the remediation effort.
- Confirmation of whether our project was in the affected subset, and which variables were accessed or decrypted, including any sealed variables.
- The time window of unauthorized access, and whether any access to databases hosted on Railway was observed.
We need points 2 and 3 to complete our data-breach assessment under GDPR (Art. 33).
Thank you,
René
0 Threads mention this feature
3 Replies
9 hours ago
I'm in a similar boat. I had a gemini key that on Oct 1st was billed $2.22 and then remained unused until the 21st where it was chaged $100 and on the 22nd it was charged $200. I missed the first set of emails, but they did send me emails "Early signal anomaly: Unusual cost spike of $103 on Gemini API in project ". I've since requested a price adjustment but have not heard back yet, my issue is awaiting review. I'm not entirely sure what the total was as the ticket says $336.41 but I was only ever billed for $100 and $200 via email (and on my credit card).
I would appreciate some account credit in good faith for the fraudulent charges. I can provide receipts as necessary.
30 minutes ago
Same situation here - $100 in Gemini fees billed in a day when usually I'm at under $1 a month.
30 minutes ago
Is there a way to contact Railway support about these kinds of things?