Railway, the platform-as-a-service provider, said an unauthorized party may have accessed encrypted customer environment variables and, for some customers, obtained the decrypted contents. The company detected anomalous activity on the systems that store those variables earlier this week and has told all users to rotate their secrets.
What Railway Says Was Accessed
Environment variables on the platform commonly hold API keys, database credentials and registry credentials. Railway said only a “subset of users” is affected, but it urged every user to rotate secrets and check logs. The company gave no number of affected accounts. Railway has about 4.8 million users and runs more than 16 million services.
A Campaign Aimed at Platform Companies and AI Inference Providers
Railway described the incident as part of a series of attacks on platform companies that target AI inference providers. Those providers were notified and told to revoke keys. The company has not named the attacker or detailed how the intruder reached the systems storing the variables. Railway said the earlier-in-the-week anomaly was found on the specific systems that hold those variables, and it described the exposure as covering both the encrypted values and, for some users, their decrypted contents.
Crypto Wallet Thefts Tied to the Breach
Researcher Taylor Monahan said an attacker address, 0xd9773325282874d18cb83f1fe50f14c39750b2ee, drained crypto wallets whose private keys were stored on Railway, according to The Hacker News. The first theft occurred at 7:36 p.m., at least two hours before Railway disclosed the incident.
The timing shows that the intruder was already using stolen credentials before customers received any warning, which is what makes the gap between detection and public notice important to those holding keys on the platform.
Customers Who Stored Private Keys as Variables
The reported thefts involve wallets whose private keys sat in Railway environment variables. For those customers, the variable contents were the keys to funds, and the reported draining happened without any further compromise beyond the secret itself.
Railway Pauses Deployments and Invalidates API Tokens
Railway paused all deployments, rotated all bucket credentials and invalidated API tokens. As of 08:44 UTC on October 22, builds had been restored for Pro and Enterprise customers. Hobby, Free and Trial accounts were still waiting for restoration.
The company is giving direct notice to accounts it has confirmed as compromised, and it has asked upstream providers to revoke keys that may have been exposed. The invalidation of API tokens means customers who use automation against Railway’s API need to generate new ones.
Railway’s Timeline From Detection to Partial Restoration
Railway detected the suspicious activity around October 21 and made its public disclosure on October 22, pausing deployments and beginning partial restoration the same day. Restoration was tiered by plan, with Pro and Enterprise builds returning first and Hobby, Free and Trial accounts still pending at the last update.
Wider Exposure Through Hosted Applications
A compromise of a platform’s environment variable store reaches beyond the platform. The credentials held there open doors into databases, third-party services and container registries used by the hosted applications. Railway’s decision to tell AI inference providers to revoke keys shows that the secrets in question included credentials for services outside Railway itself.
The lack of a count leaves the scale unclear. A platform with 4.8 million users and over 16 million services holds a large volume of secrets, and Railway’s statement that only a subset is affected does not say whether that subset numbers in the hundreds or the hundreds of thousands. The company has not said whether decrypted values were taken in bulk or from specific accounts.
The disclosure also leaves open how the intruder obtained the ability to decrypt variables that were stored in encrypted form, a question Railway has not addressed publicly. Railway’s description of a broader series of attacks on platform companies suggests that other providers may be dealing with related activity.
