Railway Breach Puts Customer Secrets at Risk and Prompts Calls to Rotate Credentials

Platform-as-a-Service provider Railway has disclosed "anomalous activity" in systems that store customer environment variables. These are settings that hold sensitive data such as API keys and database credentials, kept outside a program's source code. Railway found that an unauthorised third party may have accessed encrypted variables and, in some cases, obtained the decrypted contents. The company says only a "subset of users" is affected, but it has not said how many.

Railway believes the incident is likely part of a series of attacks aimed at platform companies, with the end goal of compromising AI inference providers. It has notified upstream providers so they can revoke keys and prevent misuse. Security researcher Taylor Monahan reported that the attackers also drained cryptocurrency wallets whose private keys were stored on Railway, with the first known theft occurring at least two hours before the official disclosure. Railway has rotated all of its bucket credentials and invalidated its API tokens. Builds are restored for Pro and Enterprise workspaces, while work continues for Hobby, Free and Trial tiers. Some builds are still failing and deployments face longer waits.

The incident comes as attackers increasingly use AI in their operations and break into cloud environments to run large language models at the victim's expense, a practice known as LLMjacking. Customers are being urged to take precautionary steps, though the full list was not included in the excerpt of the source we reviewed.