Railway Warns Attackers May Have Decrypted Customer Environment Variables

Cloud platform Railway disclosed that an unauthorized third party may have accessed systems storing encrypted customer environment variables and, in some cases, obtained the decrypted contents. The exposed environment variables can contain sensitive secrets such as API keys, database credentials, and private registry access tokens. Railway stated it believes the intrusion is part of a recent series of attacks targeting platform companies with the goal of compromising upstream AI inference providers, which have already been notified to proactively revoke keys. While initial analysis suggests only a subset of users may be impacted, Railway has paused all deployments and strongly recommended that all customers immediately rotate their stored environment variables and review service logs for anomalous activity.