Cloud developer platform Railway disclosed on Wednesday, Oct. 21, that an unauthorized third party may have accessed encrypted customer environment variables and, for some, obtained the decrypted contents. It is telling all users to rotate their keys.
Why it matters: Environment variables often hold API keys and database passwords. With them, an attacker could log in to other services as the app's owner, TechCrunch reported.
What Railway users should do
- Roll every environment variable stored in Railway, including API keys.
- Rotate private registry credentials.
- Check logs on connected services for unusual activity.
Railway said a "subset of users" appeared to be affected but urged "all users" to rotate their keys. It paused deployments while it investigated, TechCrunch reported.
Part of a bigger wave
Railway said it believes the breach is "part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." Earlier this week, coding tool OpenCode reported a similar theft of customer secrets, according to TechCrunch.
Founder and CEO Jake Cooper told TechCrunch the company will publish a post-mortem. Railway did not say how many users were affected or what the root cause was.