Railway discloses breach of customer environment variables

Cloud hosting platform Railway disclosed that it detected anomalous activity affecting systems that store customer environment variables. Its investigation so far indicates an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Environment variables commonly hold secrets such as API keys and database or registry credentials.

Railway said it believes this is part of a broader series of attacks recently targeting platform companies with the goal of compromising AI inference providers, and that it has notified upstream AI providers to proactively revoke keys. The company says its initial analysis suggests the impact may be limited to a subset of users, but it is recommending all users take precautions while the review continues.

Railway paused all deployments during the investigation, meaning customers could not roll out new versions until builds resumed, and it is directly contacting affected customers by email as it narrows the scope of impact. Railway's advice to all users is to immediately roll all environment variables, including API keys and private registry credentials, and review logs for unusual activity.

Why it matters

Developers who store secrets in Railway should rotate their API keys and credentials immediately, since attackers may already have decrypted copies.

Source: Railway