Railway breach exposes customer secrets, urges rotation

Railway disclosed anomalous activity on Wednesday related to systems storing customer environment variables. The company stated that an unauthorized third party may have gained access to encrypted variables and obtained decrypted contents in some cases. Railway clarified that these variables often contain sensitive data such as API keys, database credentials, and registry credentials. The impact is limited to a subset of users, though an exact number was not disclosed.

Security researcher Taylor Monahan reported that attackers drained cryptocurrency wallets whose private keys were stored on the platform. The first known theft transaction occurred at 7:36 p.m., at least two hours before the official disclosure. Railway believes the incident is part of a broader series of attacks targeting platform companies to compromise artificial intelligence inference providers. In response, the company notified upstream providers to proactively revoke keys to prevent their abuse.

Railway has rotated all bucket credentials and invalidated API tokens. The platform paused all deployments until the investigation completes, preventing users from rolling out new versions. As of October 22 at 08:44 UTC, builds were restored for Pro and Enterprise workspaces, though some failures persisted. Builds for Hobby, Free, and Trial workspaces had not yet resumed. Railway urges all users to immediately rotate environment variables and secrets, including private registry credentials.

The company will directly notify users whose accounts are confirmed to be compromised and provide further details. Railway hosts more than 16 million services for around 4.8 million users.