The cloud developer platform Railway has returned to normal operating capacity for its current users following a cyberattack that compromised stored environment variables. While services have been fully restored for the platform’s 5 million existing users, the company has temporarily paused new signups to maintain system stability during the recovery phase.
The security breach potentially exposed credentials in roughly 100,000 workspaces, with Railway noting that attackers targeted AI API keys to conduct model distillation. The company stated it cannot refund customers for fraudulent AI token spending incurred through compromised keys, although it is assisting in escalating refund requests to those providers. Separately, an incident responder tracked a suspected attacker wallet moving approximately $371,000 in stolen cryptocurrency across 19 chains following the intrusion.
