This was an awful write up. I want to know how, over multiple days worth of mitigations, the attacker remained in the system. I want to know exactly, from a detailed technical perspective, what flaws there were, what actions have been taken to fix them, and how you can be positive an attacker won’t gain access in the same manner. This post is so high level that it sounds like railway doesn’t even know the answer to them.

What an absolute mess. Nothing but stress with railway over the past year.

> Forensic investigation evidence indicates the attacker was likely looking for AI and platform API keys, for distilling model weights.

It’s impressive that AI API keys are so valuable that attackers are willing to devote resources to hacking a hosting company just to gain access to them.

Another thing: based the actions they have undertaken, it doesn’t sound like they’ve figured out how they were compromised.