Railway detected anomalous activity involving systems that store customer environment variables earlier this morning. Its investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Environment variables may contain secrets such as API keys or database and registry credentials.
Railway believes the incident is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers. The company has notified these upstream providers to proactively revoke all keys, stating that it takes these kinds of events extremely seriously. While its initial analysis suggests the impact may be limited to a subset of users, it is recommending that all users take precautionary steps while the review is completed.
The company strongly recommends that users immediately roll all environment variables, including any API keys, stored in Railway, as well as any private registry credentials. Users should also review logs for those services for unusual activity. All deployments are paused during the investigation, so new versions cannot be rolled out until builds are restored. Railway apologized for the inconvenience.
Affected customers will be contacted directly by email with additional details as the company confirms which accounts were impacted. Railway says it will provide new updates on the announcement and on status.railway.com as the scope of the impact is narrowed.
Source: Hacker News · Summarized by HeadlinesBriefing