# Hall Attorneys and Frost LLP File Class Action Against Railway Over Exposed Customer Credentials Filing announcement Published: November 5, 2026 Canonical: https://hallattorneys.com/news/railway-class-action November 5, 2026 complaint alleges exposed Railway credentials led to unauthorized API charges and incident-response costs for paying customers. Hall Attorneys, P.C. and Frost LLP filed a proposed class action against Railway Corporation on November 5, 2026, in the U.S. District Court for the Northern District of California, San Francisco Division. The case is Beeyo Ltd v. Railway Corporation, No. 3:26-cv-13191. The filed complaint is ECF No. 1. ## What the complaint alleges The complaint concerns Railway’s October 20–22, 2026 security incident and credentials stored in customer environment variables. It alleges that inadequate restrictions on internal access and decryption allowed an attacker to obtain customer secrets that could be used with third-party services. Beeyo alleges that a Google Cloud API key stored on Railway was used without authorization on October 21 and 22, generating approximately $2,770 in net charges, according to its estimate at filing. The complaint says Beeyo disabled affected services, replaced credentials, investigated the usage, and sought reversal of the charges. Its Google Cloud credit request remained pending, and the requested recovery must account for credits or refunds received. The complaint relies on the timing and nature of the unauthorized usage, the key’s storage on Railway, and Railway’s notice to support its allegation that the key was obtained through the incident. Those assertions are allegations, not court findings about the source of the misuse or Railway’s liability. ## Who the proposed class covers The complaint proposes the following class of paying customers, including both people and businesses: All persons and entities that paid Railway for services, whose environment-variable data stored on Railway were accessed without authorization during the October 20–22, 2026 security incident, and that incurred unauthorized third-party charges or expenses investigating, containing, or remediating the incident. Excluded are Railway and its parents, subsidiaries, and affiliates; their officers and directors and their immediate families; and the judicial officers assigned to this action and their immediate families. The proposed definition requires unauthorized access to stored environment-variable data and qualifying charges or response expenses. A Railway account or incident notice alone does not establish membership. The court has not certified a class or determined who is entitled to recover. ## Claims and requested relief The complaint asserts negligence and breach of implied contract. It seeks compensation for unauthorized third-party charges and reasonable investigation, containment, and credential-replacement costs, as well as class certification and other relief permitted by law. The requested relief also includes interest, taxable costs, and reasonable attorneys’ fees and expenses from any common fund, as permitted by law. Damages would be determined through the case, would account for applicable credits and refunds, and would not provide duplicate recovery. The complaint does not announce a settlement or payment program. ## Counsel listed in the complaint The complaint lists Christopher Frost and Kevin S. Dicker of Frost LLP, together with Nicholas Hall of Hall Attorneys, P.C., as attorneys for Beeyo. Nicholas Hall’s pro hac vice admission is identified as forthcoming in the filed complaint. The request to appoint class counsel remains subject to the court’s decision. ## Information for Railway customers Paying Railway customers who incurred unauthorized third-party charges or incident-response expenses connected to the October 20–22 incident may contact Hall Attorneys for a case review. Start with the service involved, relevant dates, any incident notice, and a general description of the charges or expenses. Explain whether a provider has issued a credit or refund. Preserve notices, usage and billing records, support correspondence, and records of remediation costs. Do not send API keys, tokens, passwords, private keys, database connection strings, authentication codes, confidential customer data, or unredacted environment-variable files in an initial inquiry. ## Case documents Case overview: https://hallattorneys.com/railway Docket: https://hallattorneys.com/dockets/railway Filed complaint, ECF No. 1 (November 5, 2026), pages 1–8: https://hallattorneys.com/dockets/railway/01-complaint.pdf Complaint text: https://hallattorneys.com/llms-full-railway-complaint.txt ## Contact Hall Attorneys Email: nhall@hallattorneys.com Phone: 713-428-8967 Request a Case Review: https://hallattorneys.com/connect Attorney Advertising. Responsible attorney: Nicholas Hall, Hall Attorneys, P.C., Edna, Texas. Hall Attorneys is not affiliated with Railway Corporation. The complaint contains allegations that have not been adjudicated. No class has been certified, and no outcome or recovery is guaranteed. This page provides general information, not legal advice. Contacting the firm or submitting information does not create an attorney-client relationship.