Railway says attacker reached internal systems and some customer secrets
Original title: Railway Preliminary Report: Oct 21st Security Incident
Customers who signed up before October 21 are told to rotate stored keys; Railway says attacker access ended on October 22.
Railway's October 22 preliminary report says a targeted attack from October 20 to October 22 reached a subset of internal systems. A subset of customers had encrypted secrets exposed, and some were decrypted with compromised CI credentials. Railway disabled builds, notified vendors to revoke keys, invalidated sessions, and says forensics with outside responders and authorities are still underway.
Unconfirmed: The investigation is ongoing; the claim that the goal was AI-key distillation is Railway's assessment, and exploit details are undisclosed.
- Railway places the attack from October 20 at 13:58 UTC to October 22 at 03:32 UTC.
- On October 21 the attacker queried encrypted environment variables; a subset were decrypted.
- Railway says it is withholding exploit details and the scale of impact.
- Enterprise and Pro builds were restored on October 22, with broader service recovery later that day.
Impact: Encrypted customer secrets and some API credentials exposed
- 1.Rotate keys stored on Railway if the account was created before October 21.
From the original article
9 min read at blog.railway.com
Railway identified a security incident that ultimately led to unauthorized access to a subset of internal Railway systems. This is a follow up to the initial security disclosure published on October 21st . Our forensic investigation is still ongoing.
By blog.railway.com via insom · blog.railway.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.