Railway Mandates Immediate Credential Resets Following Security Breach and $371,000 Crypto Theft Allegations

Railway, a cloud deployment platform, has strongly urged all users to immediately replace stored secrets following a disclosure on Oct. 21 revealing that an unauthorized attacker may have accessed encrypted customer environment variables and read some of their contents.

The company warned that these variables could contain sensitive information, including API keys, database credentials, and private registry credentials. Although initial analysis suggested the breach’s impact might be confined to a subset of users, the security advisory urged all customers to replace stored variables and credentials immediately and to closely review service logs for any unusual activity.

Railway believes this incident is part of a coordinated series of attacks targeting platform companies in an effort to compromise AI inference providers. The company stated that it has proactively notified upstream providers to revoke affected keys. However, it has not yet disclosed the root cause of the breach or the total number of affected customers.

Separately, on-chain investigator @tayvano_ alleged that cryptocurrency theft occurred involving keys stored on Railway. The investigator estimated losses at approximately $371,000 across at least 19 EVM-compatible chains and identified an address believed to belong to the attacker.

Railway has yet to confirm the alleged theft, its connection to the security incident, or the estimated $371,000 in losses.

For crypto teams running applications on the platform, the practical response is to review which credentials their applications store on Railway and assess the scope of access those credentials have to external services. Railway’s security recommendation encompasses all environment variables, API keys, and private registry credentials stored on the platform.

Credential resets and the partial return of builds

During the investigation, Railway initially paused all deployments, preventing customers from rolling out new versions of their applications. This pause created an additional obstacle for customers attempting to deploy replacement credentials, compounding the task of revoking potentially exposed credentials at the issuing services.

In addition to securing customer credentials, Railway reset credentials for access to its own platform. At 04:17 UTC on Oct. 22, the company announced that it had invalidated all Railway API tokens. Customers who used these tokens to integrate with the platform’s public API were instructed to create replacement tokens.

By 12:30 UTC on Oct. 22, Railway reported that deployment wait times were improving and that most queued deployments were starting sooner. Builds became available for Pro and Enterprise workspaces, while the company continued working to restore access for Hobby, Free, and Trial tiers. Some deployments still experienced delays.

Railway’s Oct. 22 AWS guidance advises customers to deactivate potentially exposed access keys, deploy replacements, and check CloudTrail and billing records for any activity they did not generate. Similarly, the platform’s Google Cloud guide recommends disabling potentially exposed service-account keys, replacing them, and reviewing Cloud Audit Logs and billing.

The Google Cloud guide includes a timing caveat: short-lived tokens already issued from a disabled key may remain valid for up to an hour.

Railway stated that it would notify affected customers via email as their accounts are confirmed.

Source link