Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week.
The company says its investigation indicates that, in some cases, an unauthorized third party may have obtained decrypted variables and urges all users to proactively rotate secrets and credentials.
“Our investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents,” Railway says.
“Environment variables may contain secrets such as API keys or database and registry credentials,” the company clarifies.
Railway is a cloud platform for developers to deploy and run applications, APIs, databases, and various backend services. It has around 4.8 million users and hosts more than 16 million services.
The service stores deployment-related configuration settings and credentials in environment variables, which the incident exposed.
Railway says the incident was part of a series of attacks targeting AI inference providers, which were notified directly and advised to revoke all their keys as a precaution.
AI inference providers are services that run AI models and return answers to Railway-hosted applications.
Although initial analysis suggests only a subset of users may be affected, Railway urges all users to immediately rotate environment variables and secrets stored on the platform, including private registry credentials, and check associated service logs for unusual activity.
Railway also said it has paused all deployments until the investigation completes, so users cannot roll out new versions during this time.
According to the latest status page update, as of October 22 at 08:44 UTC, Railway had restored builds for Pro and Enterprise workspaces, but deployments remained delayed, with many queued.
Builds had not yet resumed for Hobby, Free, and Trial workspaces, with restoration planned in that order.
Railway said it will directly notify users whose accounts are confirmed to be compromised and provide further details.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.