Railway urges all users to rotate keys after cyberattack

Development platform Railway says a cyberattack may have exposed some customer secrets, prompting it to urge all users to revoke and rotate their API and cloud keys.

In a blog post on Wednesday, Railway said unidentified attackers may have accessed encrypted environment variables and decrypted some of them. Such variables often contain passwords and API keys that apps use to connect to services such as cloud storage and databases. An attacker with those secrets could access data as though they were the account holder.

Railway’s initial analysis suggests the breach affected a subset of users, but the company advised all users to rotate their keys. It also paused customer deployments while it investigates, freezing customer websites and apps. Railway has not said how many users were affected or identified the incident’s root cause.

The company said the breach was likely part of a broader campaign targeting platforms to compromise AI inference providers. The source report says it remains unclear how the attack happened or which Railway systems were compromised. Railway did not immediately respond to a request for comment.