Railway warns devs to rotate secrets after potential breach

Railway, a cloud hosting platform used by millions of developers, identified suspicious activity indicating that an unauthorized third party may have accessed encrypted environment variables and, in some cases, obtained decrypted contents. These environment variables often contain sensitive secrets like API keys and database credentials. The breach appears connected to a broader campaign targeting AI inference providers. Railway has halted deployments temporarily and urges all users to rotate secrets and monitor for unusual activity. The company is restoring services in phases and will notify users with confirmed compromises.

Potential exposure of decrypted environment variables containing sensitive credentials such as API keys and database access information could allow attackers to compromise user applications and services hosted on Railway. The breach may enable unauthorized access to user resources and data. Although only a subset of users appears affected, the risk extends to all users due to the nature of the stored secrets. Deployment pauses may disrupt user workflows temporarily.

Railway advises all users to immediately rotate all environment variables and secrets stored on the platform, including private registry credentials. Users should also review service logs for any unusual activity. Railway has paused deployments until the investigation concludes and will notify users with confirmed account compromises. Follow Railway's official communications for updates and remediation instructions.