OpenRouter API Key Breach: Take Action NOW!

🔥

If you have any OpenRouter API Keys (and I know you do if you use WordCrafter), you need to take action now! Don't wait. Bank accounts and credit cards are being drained as we speak, due to a data breach on 21 October 2026.

First, what happened:

On October 21, 2026, the cloud platform Railway issued a security disclosure advising users who deploy environments connected to OpenRouter to immediately audit their setups, disable potentially exposed keys, and monitor activity logs for unauthorized requests.

Although not all keys were breached, there are still reports of hundreds, maybe thousands (by now) sold on the Dark Web, and financial attacks are under way.

NOTE: You do NOT have to be a client of the Railway platform to be at risk! So take the time to disable all your current OpenRouter API Keys and issue only essential new ones.

It's not hard to safeguard yourself, and it only takes a few minutes. How to proceed:

Open your OR account and go to API Keys. Make a list of all your active keys. (A screenshot works.)
Disable ALL your keys. (I had 9, several of them 'fallow' but still showing active.)
Issue new keys, one at a time, for any essential apps or platforms you use. (I actually need 3.)

Some safety/security guidelines for OR Keys:

Always, always, always copy the key down somewhere secure! (I build a document, put that on a flash drive, and decouple from my machine: Air-gapped from the Web.) You only get to see that key once, and OR can never show it to you again. Of course, if you forget, simply kill that key and start over.
Put in an expiration date. I know, it's a hassle when it expires and you have to get another key. The good thing is, it's easy to reissue and then install in most apps. The small cost in time is worth it for security.
NEVER give a key an Unlimited budget! This is how hackers are sucking thousands from credit cards and bank accounts. You can always adjust your level of risk against the repeated hassle of topping off manually. For me, I never give a key more than $50 before I have to top off. Most keys, I have $10 or $20 budgets. If I find I'm topping off too frequently, I simply adjust the budget. But don't get lazy here! This level is your best cash-safety backstop.

I know, the odds of you becoming an API Key breach victim are small, and it's a hassle to always be diddling with your OR account. For me, the hassle/discipline is a small price to pay to guarantee I never have to talk to my bank about the thousands of dollars I lost because I couldn't be bothered. (Note: If the bank/CC company decides you were 'less than diligent' in your handling of this issue, they won't be obligated to cover your loss. Just sayin'.)

Go NOW and fix it, and stay safe and secure on the Web...

4 comments

OpenRouter API Key Breach: Take Action NOW!