Railway urges all users to rotate keys after secrets were accessed
Original title: Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
Hackers may have decrypted environment variables for a subset of users; Railway paused deployments while it investigates.
Railway confirmed a cyberattack that may have exposed encrypted environment variables and, for some of them, decrypted contents such as passwords and API keys. The company said its initial analysis points to a subset of users but told all users to revoke and rotate API and cloud keys. It paused customer deployments during the investigation. Railway did not state how many users were affected, the root cause, or which systems were compromised, and it has not confirmed any ransom demand.
Unconfirmed: Railway has not confirmed how many users were affected, the root cause, or any contact from the attackers.
- Railway said attackers may have obtained decrypted environment-variable contents for some users.
- It asked every user to revoke and rotate API and cloud keys.
- Customer deployments were paused, freezing customer websites and apps.
- The company linked the incident to a broader push against AI inference providers.
- It did not disclose a user count or the attack's root cause.
Impact: Customer passwords, API keys, and cloud secrets may be exposed
| Product | Affected |
|---|---|
| Railway | — |
- 1.Revoke and rotate all Railway-related API and cloud keys.
From the original article
2 min read at techcrunch.com
The vibe-coding platform said all of its customers should revoke and rotate their private keys, after hackers were able to decrypt some customer secrets.
By Zack Whittaker · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.