Railway discloses security incident: some users’ environment variables and API keys may have been leaked, all deployments suspended

Odaily reports that cloud application deployment platform Railway has issued a security notice stating that on October 21 it detected abnormal activity in the system that stores customer environment variables. A preliminary investigation shows that unauthorized third parties may have accessed some encrypted environment variables and obtained the decrypted contents of some of them, involving sensitive information such as API keys, database credentials, and private image registry credentials.

Railway stated that the incident may be related to a recent series of attacks targeting platform companies, with the attackers suspected of attempting to breach an AI inference service provider. The platform has notified relevant upstream service providers to proactively revoke keys.

At present, preliminary analysis indicates that the scope of impact may be limited to some users, but Railway still recommends that all users immediately rotate the environment variables, API keys, and private image registry credentials stored on the platform, and check relevant service logs for abnormal activity.

Railway has suspended all deployments, and new version releases are temporarily unavailable. The platform said it will directly notify affected customers by email after confirming the affected accounts and will continue to disclose investigation progress.