Railway says intruder may have decrypted customer secrets, urges credential rotation

Platform-as-a-Service provider Railway disclosed on October 21 that it had detected "anomalous activity" involving systems that store customer environment variables, and that an unauthorized third party may have accessed encrypted variables and, for some of them, obtained the decrypted contents. Because environment variables commonly hold API keys, database credentials and registry passwords, the company urged customers to rotate their secrets immediately.

What happened

In its security disclosure, Railway said the activity was detected on the morning of October 21 and that its initial analysis suggests the impact may be limited to "a subset of users." The company did not say how many accounts were affected, how the attacker gained access, or what the root cause was, and said the investigation is ongoing. Railway said it will contact affected customers directly by email.

Railway said it believes the incident is part of "a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." The company did not name the attackers.

According to The Hacker News, security researcher Taylor Monahan reported that the attackers used the access to drain cryptocurrency wallets whose private keys were stored on Railway, with the first known theft transaction occurring at least two hours before the public disclosure. This claim comes from the researcher and has not been confirmed by Railway.

Railway's response

Railway said it paused all deployments during the investigation and notified upstream providers so they could proactively revoke exposed keys. The Hacker News reported that the company also rotated all Railway bucket credentials, invalidated Railway API tokens and restored builds first for Pro and Enterprise workspaces, while Hobby, Free and Trial workspaces were still waiting. On October 22, Railway published a series of follow-up recommendations covering checks for anomalous AWS, GCP and GitHub access, unexpected usage in Stripe and AI provider accounts, and rotation of PostgreSQL, MySQL, Redis and MongoDB credentials.

Who is affected

Any organization or developer that stored secrets in Railway environment variables should treat them as potentially exposed until Railway confirms otherwise. The Hacker News linked the incident to the wider trend of "LLMjacking," in which attackers use stolen credentials to run AI models at victims' expense, so keys for AI services deserve particular attention.

What to do

Railway recommends rolling every environment variable stored on the platform, including API keys and private registry credentials, and reviewing logs of the connected services for unusual activity. Teams should also rotate database passwords, check cloud provider and GitHub audit logs for unexpected access, and review billing and usage dashboards of payment and AI providers. Any crypto wallet keys kept in Railway variables should be considered compromised and funds moved to new wallets. Updates are posted on Railway's blog and status page.