Railway Security Disclosure: Wednesday October 21st

On Wednesday, October 21st, Railway detected suspicious activity involving systems that store customer environment variables. Further investigation revealed that an unauthorized third party may have accessed encrypted environment variables and, for some, obtained their decrypted contents. Environment variables can contain secrets like API keys or database and registry credentials.

Railway believes this incident is part of a series of attacks targeting platform companies to compromise AI inference providers. The company has proactively notified upstream providers to revoke all keys and has advised users to roll all environment variables, API keys, and private registry credentials as a precaution. All deployments are currently paused while Railway investigates the breach.

Users are advised to review logs for unusual activity and refrain from deploying new versions until builds are restored. The company apologizes for the inconvenience and promises to notify affected accounts directly via email. Updates will be provided on the status.railway.com website as the scope of impact is clarified.