Overview
- Railway detected anomalous activity on Wednesday and said an unauthorized actor may have accessed encrypted environment variables and, in some cases, their decrypted contents.
- The company has paused all deployments, rotated internal bucket credentials, invalidated Railway API tokens, and restored builds for Pro and Enterprise workspaces while it works to restore other tiers.
- Railway urged every user to immediately revoke and rotate environment variables, API keys, and private registry credentials and to review service logs for unusual activity.
- Independent researchers reported at least one cryptocurrency wallet drain tied to private keys stored on Railway, though the company has not disclosed how many customers were affected or the root cause.
- Security firms and U.S. agencies have warned that this incident fits a broader trend of platform-targeting attacks that seek to hijack AI inference and cloud resources, which could shift compute costs and data risk onto victims.