Railway Breach May Have Exposed Customer Environment Variables and API Keys

The short version

• Railway confirmed that an intruder may have accessed decrypted customer environment variables.
• The incident affects a subset of users, though an exact count was not disclosed.
• The company has rotated its own credentials and is restoring build services for customers.

The details

Platform-as-a-Service provider Railway disclosed on Wednesday that it detected anomalous activity in systems storing customer environment variables. According to The Hacker News, further investigation revealed that an unauthorized third party may have accessed these encrypted variables. In some cases, the intruder obtained the decrypted contents. Railway stated the impact is limited to a subset of users, but did not specify how many accounts were affected. Environment variables store sensitive data such as API keys, database credentials, and feature flags. These are configured at the operating system or container level rather than being hard-coded into source code.

Railway said the incident appears to be part of a series of attacks targeting platform companies. The ultimate goal seems to be compromising artificial intelligence inference providers. The company has notified upstream providers to proactively revoke keys to prevent abuse. Customers are being urged to rotate environment variables, including any API keys stored in Railway, as well as private registry credentials. Users are also advised to review logs for those services for unusual activity.

Security researcher Taylor Monahan reported that attackers used the access to drain cryptocurrency wallets whose private keys were stored on Railway. Monahan identified the attacker by wallet address. The first known cryptocurrency theft transaction occurred at 7:36 p.m., at least two hours before Railway officially disclosed the incident. Railway has since rotated all bucket credentials and invalidated API tokens in response.

The context

Railway has restored builds for Pro and Enterprise workspaces, allowing customers to apply new credentials. The company stated it is continuing to work on enabling builds for Hobby, Free, and Trial tiers. Some builds are still failing more often than usual, and many deployments remain queued with longer than usual wait times. Railway is working on both issues.

The incident highlights a broader trend where threat actors incorporate AI into various stages of the attack lifecycle. Attackers are also obtaining unauthorized access to cloud victim environments to run Large Language Models. This leaves the victims to foot the bill for the compute resources. Railway’s disclosure comes as part of this evolving threat landscape.

What to watch

• Monitor for further disclosures regarding the number of affected users.
• Watch for updates on the restoration of build services for Hobby and Free tiers.
• Observe any additional reports of cryptocurrency thefts linked to the incident.
• Note any new information about the attackers' methods or targets.

What it means for organisations

Organisations should treat this as a potential compromise of all secrets stored on the platform. Teams usually need to verify if their critical infrastructure relies on Railway for secret management. Check whether upstream providers have already revoked keys or if manual intervention is required. Incident response leads should coordinate with development teams to ensure all rotated credentials are updated in deployment pipelines. Security officers must assess if any exposed keys grant access to production databases or external APIs. Communication plans should address how to inform stakeholders about potential service disruptions during credential rotation.

What to do and how to stay safe: Railway

• Rotate all environment variables, API keys, and private registry credentials stored in Railway immediately.
• Review service logs for unusual activity that may indicate unauthorized access or data exfiltration.
• Check with upstream providers to confirm if keys have been revoked or if additional steps are needed.
• Monitor for any signs of further unauthorized access or service disruptions in your deployments.

Step-by-step guide: Secure Home Routers for Small Business Networks

General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Railway confirm that customer data was stolen?

Railway stated that an unauthorized third party may have accessed encrypted environment variables and obtained decrypted contents in some cases.

How many users were affected by the Railway breach?

Railway said the impact is limited to a subset of users but did not disclose an exact number.

Are Railway's build services working again?

Builds are restored for Pro and Enterprise workspaces, but Hobby, Free, and Trial tiers are still being worked on.