Railway Reports Possible Breach of Customer Environment Variables
Cloud platform Railway has detected unauthorized access to systems storing customer environment variables and is urging all users to rotate their keys and credentials. Deployments are paused for now.
Railway, a cloud platform that lets developers deploy and run applications, has announced a security incident. On Tuesday morning the company noticed unusual activity in systems that store customer environment variables, which are settings often used to hold secrets such as API keys, database credentials and container registry credentials.
What is known so far
The investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, in some cases, obtained their decrypted contents. Railway believes this is part of a series of attacks aimed at platform companies, with the goal of compromising AI inference providers. The company has notified those providers and asked them to revoke all keys proactively.
The initial analysis suggests the impact may be limited to a subset of users. Even so, until the review is complete, the company is asking every customer to act as a precaution.
What users are advised to do
Railway strongly recommends immediately rolling all environment variables stored on the platform, including API keys, as well as any private registry credentials. Users should also review the logs of the affected services for unusual activity.
All deployments are paused during the investigation. Until builds are restored, new versions cannot be rolled out. The company apologized for the inconvenience.
Once it confirms which accounts were affected, Railway will contact those customers directly by email. Further updates will appear in the announcement and on the status page at status.railway.com as the scope of the impact is narrowed.
