Cloud hosting platform Railway has urged all users to replace their API keys and other stored credentials after discovering a cyberattack that may have exposed sensitive customer data. In an October 21 blog post, the company said an unauthorised third party may have accessed encrypted environment variables and decrypted some of them.
Environment variables can contain sensitive information, including API keys, database passwords and private registry credentials. Railway said its initial investigation suggested that the attack affected only some customers, but it advised all users to replace their credentials and check for suspicious activity.
The company said it detected unusual activity in systems storing customer environment variables on October 21. Railway suspects the breach may be part of a broader campaign targeting technology platforms to gain access to AI inference providers.
“We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers,” Railway said.
Railway said it had notified the relevant upstream providers so they could revoke potentially compromised keys. However, Railway has not explained how the attackers gained access, revealed how many customers the breach affected or identified which credentials the attackers may have exposed.
Railway asks users to check OpenAI, Anthropic and GitHub accounts
Following the disclosure, Railway published separate security guides for customers using OpenAI, Anthropic and GitHub.
It advised OpenAI and Anthropic users to delete potentially exposed API keys, generate replacements and examine usage records for unauthorised requests or unexpected charges. Railway also advised customers to review account memberships and access logs for signs of suspicious activity.
For GitHub users, Railway recommended reviewing login records, authorised applications, access tokens, SSH keys and repository settings for signs of unauthorised access.
The company also issued guidance covering other services, including AWS, Google Cloud, Stripe and databases.
Railway restores deployments after temporary suspension
Railway initially suspended all new builds and deployments while investigating the incident, preventing customers from deploying applications with replacement credentials.
According to its October 23 status update, builds and deployments had resumed across Enterprise, Pro, Hobby, Trial and Free plans. However, new customer registrations remained temporarily suspended.
Railway also invalidated existing platform API tokens and began contacting affected customers directly. It said it expected to publish a preliminary incident report on October 23.
Attack follows other security incidents
The disclosure follows a similar incident involving open-source AI coding tool OpenCode, which reported earlier this week that attackers had stolen API keys and other secrets belonging to more than 1% of its customers. OpenCode linked the attack to an AI model distillation operation.
The incidents also come after the US Cybersecurity and Infrastructure Security Agency (CISA) warned that China-based AI companies were conducting large-scale attacks against US companies to improve their AI models. However, no confirmed connection between that warning and the Railway breach has been established. Separately, researchers disclosed two critical vulnerabilities in the widely used PHP programming language this week.
Read more:
- SBI confirms data of 3,897 customers exposed on dark web, silent on whether customers were informed
- Explained: eMudhra’s weak private keys used to issue website certificates were exposed; what it means
The post Railway urges users to revoke API keys after cyberattack exposes customer secrets appeared first on MEDIANAMA.