Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. The impact, it said, is limited to a "subset of users,
Railway, a Platform-as-a-Service provider, disclosed on Wednesday that an unauthorized third party may have accessed encrypted environment variables, possibly obtaining decrypted contents. The impact is limited to a subset of users, but the company did not disclose an exact number. Environment variables are user-defined key-value pairs used to store sensitive data like API keys, database credentials, or feature flags.
Railway believes the incident is part of a series of attacks aimed at compromising AI inference providers. The company has notified upstream providers to revoke keys and urged customers to rotate their credentials as a precaution. It has rotated all Railway bucket credentials and invalidated Railway API tokens, restoring builds for Pro and Enterprise workspaces.
However, builds for Hobby, Free, and Trial workspaces remain unavailable, with some builds failing more frequently and deployments experiencing longer wait times. The incident highlights the growing trend of threat actors incorporating AI into their tactics, techniques, and procedures, as well as the potential for LLMjacking, where attackers steal access to someone else's AI model for malicious purposes.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
