Railway Says Customer Secrets May Have Been Exposed in Security Incident
The cloud development platform said an unauthorized party may have accessed customer environment variables, including some decrypted values containing API keys and other credentials.
Topics
News
- External Review Finds Flaws in OpenAI’s Agent Monitoring System
- Microsoft AI System Outperforms General Physicians in Diagnostic Tests
- How Sundar Pichai Uses AI Agents to Track Google Operations
- Tech Mahindra Partners With SpaceXSI to Scale AI-Powered Coding
- Barclays to Cut 5,000 Jobs as AI Drives Cost Savings
- CERT-In Warns of Compromised eMudhra Certificate Authority Keys
Railway has disclosed a security incident in which an unauthorized third party may have accessed customer environment variables, potentially exposing sensitive credentials used to connect applications with databases, cloud services and AI providers.
The company said in a security disclosure on October 21 that it detected unusual activity involving systems that store customer environment variables. Its investigation indicates the attacker may have accessed encrypted variables and obtained the decrypted contents of some of them.
Environment variables can contain secrets including API keys, database passwords and private registry credentials. Railway has not disclosed how the attacker gained access, how many customers were affected or whether stolen credentials were subsequently abused.
The company said its initial analysis suggests the incident may be limited to a subset of users but advised all customers to rotate environment variables and private registry credentials and examine connected-service logs for unusual activity.
Railway said it believes the incident forms part of a broader series of attacks against platform companies aimed at compromising AI inference providers. It said those providers had been notified and asked to revoke affected keys proactively, but did not identify them.
The company has since published separate guidance for customers using services including Anthropic, OpenAI, OpenRouter, xAI, AWS and Google Cloud, advising them to replace potentially exposed credentials and review activity for unauthorized use.
Railway also rotated all storage bucket credentials and invalidated its API tokens as precautionary measures.
The incident disrupted Railway’s build and deployment systems. As of 06:12 UTC on October 22, Railway’s status page said Enterprise deployments were operating normally again, while the company was still working to restore builds for Pro, Hobby, Free and Trial accounts.
Railway said customers confirmed as affected would be contacted directly while the investigation continues.
