Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack

Development platform Railway urged all users to revoke and rotate their API and cloud keys following a cyberattack that compromised customer data. The company announced the security incident in a Wednesday blog post. Unidentified hackers may have accessed encrypted environment variables and decrypted their contents for certain accounts.

These variables store passwords and API keys that applications need to access external services like databases. Railway warned that attackers possessing these secrets could log in and access data as the rightful owner. While initial analysis indicated only a subset of users was affected, Railway advised everyone to rotate their keys to prevent abuse.

The company also paused all customer deployments during the investigation, which temporarily froze user websites and applications. Railway did not disclose the root cause of the incident, the specific number of impacted users, or whether it received a ransom demand. Railway stated that the breach likely formed part of a broader campaign targeting platforms to compromise artificial intelligence inference providers.

Similar recent incidents include an attack on open-source AI coding tool OpenCode, where hackers stole over one percent of customer API keys using AI distillation techniques.