Overview
- Railway detected anomalous activity in systems that store environment variables Wednesday and says an unauthorized party may have accessed encrypted values and for some users obtained decrypted contents.
- The company paused deployments during its review, rotated Railway bucket credentials, invalidated Railway API tokens, and has restored builds for Pro and Enterprise workspaces while Hobby and Free builds remain being re-enabled.
- Railway is telling all customers to immediately roll environment variables, API keys, and private registry credentials and to review service logs, and it says it will email directly any accounts it confirms were affected and post updates to its status page.
- Security researcher reports say attackers used exposed private keys to drain cryptocurrency wallets with at least one theft before the public disclosure, a claim Railway has not fully quantified while its investigation continues.
- Railway links the breach to a recent campaign that targets platform providers to hijack AI inference resources — a tactic that can hide attackers’ activity and shift compute costs onto victims, so upstream providers have been notified to revoke exposed keys.