RAILWAY has disclosed a security incident affecting its cloud platform, reporting anomalous activity on October 21 that potentially exposed customer environment variables. The firm warned that an unauthorised party “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” Since these variables commonly contain API keys and database credentials, the incident carries the risk of abuse across connected services.
Railway has not provided a precise customer tally, stating the initial analysis “suggests the impact may be limited to a subset of users,” but urged all customers to act immediately and said it would email affected users directly once identity is confirmed. The company offered a motive, suggesting the incident may be part of a broader wave targeting platform companies to compromise AI inference providers, and has already requested upstream providers revoke affected keys as a precaution.
The outage disrupted builds and deployments across the platform, with the status page noting that dashboard, API, CLI and support sites were down and that builds were offline as of 02:19 UTC on 22 October. Storage bucket credentials are being rotated, and new credentials appear in the dashboard, though redeployments cannot pick them up until builds resume. Railway advised customers to roll all environment variables, including API keys and private registry credentials.
Practical steps include rotating every secret in Railway environment variables, resetting database credentials, checking AI provider accounts for unusual usage, reviewing cloud logs for anomalies, and reconnecting GitHub and redeploying buckets once builds resume. The firm emphasised that one intrusion can propagate to downstream services, underscoring the importance of timely containment and coordinated credential revocation.