Railway, a cloud platform developers use to deploy apps, APIs and databases, has warned customers that an unauthorized third party may have accessed the systems that store customer environment variables. In its security disclosure of October 21, the company said its investigation “indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” Environment variables often hold secrets such as API keys and database or registry credentials.
Railway says it believes the incident is part of a series of attacks on platform companies aimed at compromising AI inference providers, and that it has notified those upstream providers so they can revoke all keys as a precaution. It says the impact may be limited to a subset of users, but recommends everyone act. BleepingComputer reports Railway has around 4.8 million users and hosts more than 16 million services.
All deployments were paused during the investigation, so new versions could not be rolled out. As of an October 22 status update at 08:44 UTC, BleepingComputer reports builds had been restored for Pro and Enterprise workspaces, with deployments still delayed; Hobby, Free and Trial workspaces were next in line. Railway says it will email customers it confirms were affected. Its blog also lists two follow-up recommendations on checking for anomalous AWS and GCP access, which we did not review in full.
How to check if you’re affected
Affected products are any services or projects hosted on Railway that store environment variables. Railway says the scope is still being narrowed and recommends that all users take these steps as a precaution:
- Roll every environment variable stored in Railway, including API keys, and any private registry credentials.
- Review the logs of those services for unusual activity.
- Railway says it has asked AI inference providers to revoke keys proactively; if you stored a provider key in Railway, rotating it at the provider is the cautious route (our reading, not Railway’s instruction).
Check Railway’s status page for build and deployment restoration, and watch for an email from Railway if your account is confirmed as affected.