Railway says intruder may have accessed customer environment variables
Railway detected anomalous activity on systems storing customer environment variables, some of which may have been decrypted. Deployments are paused while it investigates.
Railway said on 21 October that it detected anomalous activity involving systems that store customer environment variables. Its investigation indicates an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Environment variables may contain secrets such as API keys or database and registry credentials.
Railway believes the incident is part of a series of attacks targeting platform companies with the aim of compromising AI inference providers, and says it has notified those upstream providers to revoke keys.
Its initial analysis suggests the impact may be limited to a subset of users. As a precaution, Railway recommends that all users roll every environment variable stored on the platform, including API keys and private registry credentials, and review service logs for unusual activity.
All deployments are paused during the investigation. Railway says it will email affected customers directly and post updates on status.railway.com.