Railway says an attacker accessed some of its internal systems and may have obtained customer secrets after they were decrypted, prompting a broad warning to change credentials as the company investigates an intrusion it says was contained on October 22.
Railway, a developer platform, said in its preliminary report that the attack began on October 20. Railway confirmed the intruder no longer had access to its systems by 03:32 UTC on October 22. The exposed environment variables, which are stored software settings, could contain API keys, database passwords and login details for private registries where software is stored.
These secrets may give access to customers’ other services. Railway said early findings suggest the campaign was aimed at obtaining keys from AI providers. But the company has not disclosed a confirmed motive, the full scope of the incident or the specific method used to break in.
The company believes only some customers were affected. It recommends that users who signed up before October 21 replace their stored keys. Railway has notified customers who were directly affected.
Railway paused the process of building software during its response. This disrupted software rollouts and access to some platform services. Railway said it hired outside experts who specialize in responding to cyber incidents and contacted authorities.
On October 24, Railway clarified that AI providers had recently revoked API keys as a precaution in response to this incident. The company said those revocations were not evidence of a new attack. The company advises users to replace stored credentials and check records of service activity for anything unusual.