Railway, a cloud platform serving approximately 4.8 million users and hosting over 16 million services, issued an urgent advisory this week following the discovery of suspicious activity targeting its environment variable storage systems.
According to the company's investigation, an unauthorized party potentially gained access to encrypted environment variables stored on the platform, and in certain instances, obtained the decrypted contents. "Our investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents," Railway stated.
Environment variables on the platform can hold sensitive information including API keys and credentials for databases and registries. The incident exposed deployment-related configuration settings and credentials that developers rely on for their applications and backend services.
Railway identified the incident as part of a broader campaign targeting AI inference providers—services that execute AI models and deliver results to applications running on Railway's infrastructure. The company directly notified affected AI inference providers and recommended they revoke all associated keys immediately.
While evidence suggests only a portion of users experienced compromise, Railway is recommending that all users take immediate action. The platform is asking customers to rotate environment variables and secrets, update private registry credentials, and review service logs for signs of unauthorized access.
To contain the incident, Railway halted all deployments pending completion of its investigation, preventing users from releasing new application versions during this period. As of October 22 at 08:44 UTC, the company had restored build functionality for Pro and Enterprise workspaces, though deployments continued to experience delays with numerous jobs in queue. Hobby, Free, and Trial workspaces had not yet regained build capabilities, with restoration expected to proceed in that sequence.
Railway stated it will reach out directly to users whose accounts have been confirmed as compromised and will furnish additional information regarding the scope and impact of the incident.