Railway halted all deployments Wednesday after discovering an unapproved party may have accessed customer environment variables.
The cloud platform has instructed all users to rotate stored secrets immediately.
October 21 disclosure says an intruder may hold decrypted secrets
Railway said in a security disclosure posted October 21 that it detected “anomalous activity” Wednesday morning in systems that store customer environment variables.
Those variables hold the settings and secrets an app needs to be able to run. Usually that’s API keys, and database and registry credentials.
Railway’s own account hedged on scope. The disclosure says the intruder “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.”
The company said initial analysis indicated a limited subset of users may be affected. The review is ongoing and everyone must act as if they have been exposed.
In January, Railway announced that 2 million builders and tens of thousands of companies use the platform, ranging from small shops to Fortune 500s.
Deployments are on pause, including for Enterprise customers. The company apologized for the disruption, saying customers won’t be able to deploy new versions of their apps until builds are reinstated.
Railway had earlier sketched a staged restart, with Enterprise workspaces leading the charge, followed by Pro, Hobby, Free and Trial plans.
Guides tell users to check OpenAI, Anthropic and Stripe usage
Railway wants users to immediately roll each environment variable on the platform, such as API keys and private registry credentials. Next is to comb through service logs for anything unusual.
Affected accounts will receive a direct email once confirmed by Railway. Railway is also rotating all Railway storage bucket credentials, and the new ones are surfacing in dashboards automatically.
As part of its mitigation, Railway also signed some users out by invalidating OAuth sessions. The outage also hit its API, dashboard and support site at station.railway.com.
On October 22, Railway released guides encouraging users to monitor their systems for any unusual access attempts to Google Cloud and Amazon Web Services. There are also guides concerning abnormal use of OpenAI, Anthropic, Grok, OpenRouter and Stripe so that the leaked keys might extend beyond Railway’s environment.
In the Google Cloud guide, users are recommended to invalidate the exposed service account key and review Cloud Audit Logs for any unauthorised actions.
The notification states that Railway considers this breach as “part of a series of attacks recently targeting platform companies with the goal of compromising AI inference providers.”
According to Railway, the company urged all of its upstream providers to invalidate all keys. The AI inference providers are responsible for running AI models on behalf of other organizations.
Cryptopolitan reported that 8 people disclosed 17,286 DOT as having been transferred through unauthorized access, and that the Fearless Wallet browser extension had sent Polkadot users’ private keys to the attacker’s server.
Security experts have reported that using inexpensive AI tools enables intrusions that could only be accomplished with state-level resources before. An intruder spent approximately $50 per attack.
If you're reading this, you’re already ahead. Stay there with our newsletter.