Overview
- Railway detected anomalous activity on systems that store environment variables on Oct. 21 and says an unauthorized party may have accessed encrypted values and in some cases obtained decrypted contents.
- The company paused all deployments, invalidated Railway API tokens, rotated internal bucket credentials, and has begun phased build restorations with Pro and Enterprise workspaces restored first.
- Railway is urging every user to immediately revoke and rotate environment variables, API keys, and private registry credentials and to review service logs for unusual activity.
- Independent researchers reported at least one alleged cryptocurrency wallet theft tied to private keys stored on Railway, a claim the company has not publicly confirmed but says it will email customers whose accounts are confirmed affected.
- Railway links the incident to a broader campaign targeting platform firms to compromise AI inference providers, a pattern that security firms and U.S. agencies have warned can let attackers steal secrets, run malicious AI agents, or shift compute costs to victims.