An intruder gained access to the internals of Railway’s cloud hosting service to extract API and database keys from various user accounts. The company advised all clients to rotate their credentials and registry secrets immediately after discovering that a third party had decrypted customer environment variables. Several accounts reported that their tokens were already drained before the official disclosure was made.
Railway took almost 15 hours to notify the thousands of affected customers after the breach was detected. The company stated the attack is part of a series targeting platform providers to compromise AI inference services such as OpenAI and Anthropic. To prevent further exploitation, Railway paused all active deployments, which currently hinders users from updating their applications with new keys.
