Railway Breach: Intruder May Have Reached Customer Secrets

Platform-as-a-Service provider Railway on Wednesday disclosed "anomalous activity" in the systems that store customers' environment variables. A deeper investigation found that an unauthorized third party may have accessed the encrypted variables and, in some cases, obtained their decrypted contents. The company said only a "subset of users" was affected but did not give a number.

Environment variables are user-defined key-value pairs that hold sensitive data such as API keys, database credentials, and feature flags. They are configured at the operating-system or container level so that values are not hard-coded into source.

Target: AI inference providers

Railway believes the incident is likely part of a campaign against platform companies whose ultimate goal is to compromise AI inference providers. It has notified upstream providers so they can proactively revoke keys and prevent abuse.

As a precaution, customers are told to rotate every environment variable stored in Railway, including API keys, along with private registry credentials, and to review service logs for unusual activity.

According to security researcher Taylor Monahan (@tayvano_), the breach also let the attackers drain cryptocurrency wallets whose private keys had been stored on Railway. The first known theft transaction reportedly occurred at 7:36 p.m. — at least two hours before the incident was officially disclosed.

Recovery

Railway has rotated all of its bucket credentials and invalidated API tokens. Builds have been restored for Pro and Enterprise workspaces, allowing customers to apply new credentials. Work continues on Hobby, then Free and Trial tiers; some builds still fail more often than usual, and many deployments remain queued with longer-than-usual waits.

The episode fits a worrying trend: attackers are not only weaving AI into stages of their operations but also seizing victims' cloud environments to run large language models on someone else's bill. The technique is called LLMjacking — stealing access to another party's AI model for free compute that the legitimate owner pays for.

Source: The Hacker News