Railway says some customer secrets may have been decrypted

Railway says attacker access ended October 22 after some customer secrets may have been decrypted; rotation and forensics continue.

Railway disclosed on October 21 that suspicious activity may have let an unauthorized party reach encrypted environment variables and, for some users, decrypted API keys and database or registry credentials. Only a subset may be affected; Railway has not named an attacker or root cause and asked AI inference providers to revoke keys. It paused deployments, rotated bucket credentials, invalidated tokens and sessions, and urged secret rotation, including for accounts created before October 21. An October 22 preliminary report says access ran from October 20 at 13:58 UTC to October 22 at 03:32 UTC and that some secrets were decrypted with compromised CI credentials. According to The Hacker News, Taylor Monahan linked a pre-disclosure cryptocurrency theft to keys stored on Railway; forensics continue and no ransom is confirmed.