Railway urges users to rotate secrets after potential breach

Cloud platform Railway is urging users to rotate secrets and credentials after detecting suspicious activity on systems that store customer environment variables earlier this week. The company says its investigation indicates that an unauthorized third party may have accessed encrypted variables and obtained the decrypted contents of some of them.

Environment variables can contain sensitive information such as API keys and database or registry credentials. Railway says the incident was part of a series of attacks targeting AI inference providers, which it notified and advised to revoke their keys as a precaution.

Although initial analysis suggests that only some users may be affected, Railway urges all users to rotate environment variables and secrets stored on the platform, including private registry credentials, and to check related service logs for unusual activity. The company has paused deployments while its investigation continues.

In a status update dated October 22 at 08:44 UTC, Railway said builds had resumed for Pro and Enterprise workspaces, but deployments remained delayed, with many queued. Builds had not resumed for Hobby, Free, and Trial workspaces; Railway said it planned to restore them in that order. The company said it would directly notify users whose accounts are confirmed to be compromised and provide further details.