Railway says intruder may have decrypted customer environment variables

Cloud platform Railway said on October 21 that it detected anomalous activity in systems storing customer environment variables. Its investigation indicates that an unauthorized third party may have accessed encrypted variables and obtained decrypted contents for some of them. The company said those variables can contain API keys, database credentials and registry credentials, while its initial analysis suggests the impact may be limited to a subset of users.

Railway urged every user to rotate all environment variables and private registry credentials stored on the platform and review service logs for unusual activity. It paused deployments during the investigation and said it would contact accounts confirmed to be affected.