Class action filed
Railway Data Breach Class Action
Enterprise and business customers · Exposed API credentials
On November 5, 2026, Hall Attorneys, P.C. and Frost LLP filed a putative class action against Railway Corporation in the Northern District of California. The complaint alleges that failures to protect credentials stored on Railway led to unauthorized third-party charges and incident-response expenses following the October 20–22 security incident. The allegations have not been adjudicated, and no class has been certified.
Enterprise and business customers: request a case review
Hall Attorneys is reviewing inquiries from enterprise customers, startups, software companies, AI developers, and other businesses affected by Railway’s October 20–22, 2026 security incident. Business inquiries are welcome regardless of whether the customer’s Railway plan was named Enterprise.
Relevant losses may include unauthorized AI, API, or cloud-service charges and documented costs to investigate the incident, contain unauthorized activity, rotate or replace credentials, and remediate affected systems. Tell us about any credits, refunds, or reimbursements so losses can be assessed without duplicate recovery.
A business does not need to have identified every charge or completed its investigation before contacting us. We review each inquiry on its facts and applicable agreements. An inquiry does not establish proposed-class membership or an attorney-client relationship.
Railway class action filed
Beeyo Ltd v. Railway Corporation, No. 3:26-cv-13191, was filed November 5, 2026 in the U.S. District Court for the Northern District of California, San Francisco Division. ECF No. 1 is an eight-page class action complaint asserting negligence and breach of implied contract and demanding a jury trial. The PDF available here is the filed complaint, without a separate cover sheet, summons, or exhibits.
Beeyo, a company that says it paid for Railway’s Pro service, alleges unauthorized use of a Google Cloud API key stored on Railway generated approximately $2,770 in net charges, along with investigation, containment, and credential-replacement expenses. The claimed connection between the key’s misuse and Railway’s systems is an allegation, not a court finding. The complaint says Beeyo’s Google Cloud credit request remained pending and that any recovery will account for credits or refunds received.
The complaint lists Frost LLP and Hall Attorneys, P.C. as counsel, with Nicholas Hall’s pro hac vice admission described as forthcoming. It does not establish appointment of class counsel, liability, a settlement, or an entitlement to payment.
Who is in the proposed class?
The complaint proposes a class of persons and entities that paid Railway for services, whose environment-variable data stored on Railway were accessed without authorization during the October 20–22, 2026 incident, and that incurred unauthorized third-party charges or expenses investigating, containing, or remediating the incident. The definition requires all three elements: payment for Railway services, unauthorized access to stored environment-variable data during that period, and qualifying charges or expenses.
The complaint does not propose a geographic restriction or separate subclasses. It excludes Railway and specified related entities and individuals, including the assigned judicial officers and their immediate families. No class has been certified. Having a Railway account, receiving a notice, or using a connected service does not by itself establish proposed-class membership.
Requested relief includes class certification, compensatory damages without duplicate recovery and accounting for credits or refunds, interest, taxable costs, permitted common-fund attorneys’ fees and expenses, and other appropriate relief. These are requests in the complaint, not relief already awarded.
What did Railway disclose?
The complaint cites Railway’s October 22 preliminary report for an October 20–22 intrusion involving compromised continuous-integration credentials and decryption of some customer environment variables. It cites an estimate of approximately 100,000 workspaces, at most 1.85% of workspaces, with potentially compromised variables. That is not a verified count of affected people, businesses, or class members.
Railway reported detecting unusual activity in systems storing customer environment variables on October 21. Its initial review indicated possible access to encrypted variables and some decrypted contents, including secrets such as API keys and database or registry credentials.
Railway said its initial analysis suggested a subset of users may be affected, but recommended protective steps for all users. It said it would email customers as affected accounts were confirmed. The disclosure does not give a final affected-account count or establish that every user’s credentials were accessed.
Hall Attorneys is reviewing the protection of stored secrets, the response to the incident, and potential consequences for users and businesses. Railway’s disclosure does not establish that every connected service or its underlying customer data was accessed.
Why do environment variables matter?
Applications often use environment variables to connect to databases, AI services, private container registries, and other systems. If someone obtains a valid secret, what they can access depends on its permissions and whether it has been revoked.
Our investigation concerns whether exposed credentials led to unauthorized API usage, unexpected charges, access to connected systems, exposed information, or response costs. These are potential consequences under investigation, not confirmed outcomes for every Railway user.
Receiving a notice or storing a secret in Railway does not, by itself, establish that a connected database, registry, or service was accessed. Relevant access logs and provider records can help determine what happened.
Companies featured by Railway
The following companies were featured on Railway’s homepage when this investigation began. We continue to review whether the incident had downstream effects on these services or their users:
- Nous Research (Nous)
- Clay
- Wispr Flow (Flow)
- Black Forest Labs
- Mem0 (mem0)
- Browser Use
Being featured by Railway does not establish that any of these companies’ credentials, systems, or users’ information were affected. Railway’s disclosure does not identify these six companies as confirmed affected accounts.
These companies are not defendants named in this complaint. Their appearance on Railway’s site does not establish membership in the proposed class or that they were affected by the incident.
We welcome information from users and businesses connected to these services who received an incident notice or have records suggesting a connection to the Railway incident. Tell us which service was involved and what happened; using one of these services alone does not establish exposure.
What has Railway told users to do?
Railway recommends rotating all environment variables stored on its platform, including API keys and private registry credentials, and checking related service logs for unusual activity. Follow the company’s official guidance and updates for your systems.
Railway’s October 21 status updates said builds and deployments were paused, including for Enterprise customers. It also reported rotating storage bucket credentials. The updates explained that customers could not redeploy services to pick up replacement credentials until builds resumed. Service availability can change; check Railway’s live status page.
Keep relevant records without delaying protective changes. Document when credentials were revoked or replaced and any obstacles to updating your applications. Do not include the secret values in those records or an initial inquiry to our firm.
Who should contact Hall Attorneys?
We want to hear from people and businesses whose API keys stored on Railway were used without authorization or were identified in an exposure notice. This includes keys for foundational LLM providers. Contact us if you:
- Were notified by Railway, an API provider, or another service that API keys you stored on Railway were exposed.
- Found use of those keys that you did not authorize, including unexplained LLM API requests, token usage, charges, or related provider alerts.
- Incurred response costs, downtime, disruption, or other losses you believe may be connected to the incident.
You can contact us after receiving an exposure notice even if you have not identified unauthorized use or charges. Do not send us the API key itself.
You do not need a notice to request a review. We will assess the available information; unusual activity or an unexpected bill alone does not establish a connection to this incident.
These invitations to contact us are broader than the complaint’s proposed-class requirements. The filed class definition requires payment for Railway services, unauthorized access during the specified incident, and qualifying charges or response expenses.
What records should you keep?
Preserve Railway notices, support correspondence, relevant service and audit logs, provider alerts, usage reports, invoices, and records of disputed charges. Record the dates of credential changes, failed deployments, service disruptions, remediation work, and related expenses.
Describe the affected project and types of credentials in general terms. Do not send API keys, tokens, passwords, database connection strings, private keys, registry credentials, or unredacted environment-variable files in an initial message. Redact secret values from images and logs before sharing them.
If additional sensitive records are needed, we will discuss an appropriate way to provide them. Keep only records you are authorized to access.
Enterprise or business losses from the Railway incident?
For an enterprise or business inquiry, include your company name, your role, and a general description of unauthorized AI/API or cloud charges, investigation work, containment, credential replacement, or remediation costs. Note any credits, refunds, or reimbursements.
Provide your name, preferred contact information, API provider, and whether the key was stored on Railway. Tell us about any unauthorized use or notice that the key was exposed, including keys for foundational LLM providers, and any related charges or response costs.
Start with a description of your records. Do not include live credentials, secret values, or confidential customer data in an initial inquiry.
Nicholas Hall
Email: nhall@hallattorneys.com
Request a Case ReviewLast reviewed:
Attorney Advertising. Responsible attorney: Nicholas Hall, Hall Attorneys, P.C., Edna, Texas. Hall Attorneys is not affiliated with Railway Corporation. The complaint contains allegations that have not been adjudicated. No class has been certified, and no outcome or recovery is guaranteed. This page provides general information, not legal advice. Contacting the firm or submitting information does not create an attorney-client relationship.