Railway says attacker may have obtained customer secrets in attack aimed at AI inference providers

Railway disclosed on its blog that an unauthorized third party may have accessed encrypted customer environment variables and obtained the decrypted contents of some variables. In a separate guide, Railway told customers using OpenAI to delete potentially exposed API keys, review usage and deploy replacement keys.

Railway said it believes the incident is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers, and that it has notified those upstream providers to revoke all keys proactively.

Environment variables can contain API keys, database credentials and private registry credentials. Railway advised all users to replace every environment variable stored on its platform and review service logs for unusual activity, even though its initial analysis indicated that only a subset of users may be affected.

Railway paused all deployments while it investigates, preventing customers from releasing new versions. The company plans to contact confirmed affected customers by email and publish further updates as it determines the scope of the incident.