Railway Says an Intruder May Have Read Customer Secrets
Deployments paused and every API token reset; Railway says the attackers were after AI inference keys.
Railway thinks it was one stop in a campaign aimed at AI inference keys.
Railway says an unauthorized party may have accessed customers’ encrypted environment variables, and for some customers obtained decrypted values. It calls the incident “part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers,” and says it notified upstream providers so they could revoke keys.
| When (UTC) | Action |
|---|---|
| Oct 21, 07:24 | Outage begins; deployments paused |
| Oct 21, 22:10 | Security notice published |
| Oct 22, 03:32 to 04:00 | Builds back for Enterprise |
| Oct 22, 04:39 | All API tokens invalidated |
| Oct 22, 07:11 | Builds back for Pro |
Railway also rotated bucket credentials, reset GitHub tokens and invalidated OAuth sessions. Its guides walk customers through checking usage on OpenAI, Anthropic, Grok, OpenRouter and Stripe accounts for anything they did not run.
@levelsio, quoting a post that said “Railway has been hacked,” wrote: “Another one. What a day.” @kimmonismus puts Railway alongside LiteLLM and Zeabur in his list of the week’s platform breaches.
Sources
- Railway · blog.railway.com
- Railway status · status.railway.com
- @levelsio on X · Oct 21, 3:27 PM PT
- @kimmonismus on X · Oct 21, 10:34 PM PT