Cloud hosting provider Railway has urged its users to rotate secrets and credentials after detecting suspicious activity on systems that store customer environment variables earlier this week.

In an incident notice, Railway said its investigation so far indicates that an unauthorized third party may have accessed encrypted environment variables and, in some cases, obtained their decrypted contents. The company noted that environment variables often contain sensitive secrets such as API keys, database credentials, and registry credentials.

Railway is a platform used by developers to deploy and run applications, APIs, databases, and backend services. It serves roughly 4.8 million users and hosts more than 16 million services, many of which rely on environment variables for deployment configuration and authentication.

Part of a Broader Attack Wave

Railway said the incident appears connected to a series of attacks targeting AI inference providers, the services that run AI models and return results to applications hosted on Railway. Affected providers were notified directly and advised to revoke all their keys as a precautionary measure.

Recommended Actions

Although Railway’s initial analysis suggests only a subset of users may be impacted, the company is urging all users to take precautionary steps, including:

  • Immediately rotating all environment variables and secrets stored on the platform
  • Rotating private registry credentials
  • Reviewing associated service logs for signs of unusual activity

Railway said it will directly notify any users whose accounts are confirmed to be compromised and provide further details at that time.

Deployments Paused

As a precaution, Railway paused all deployments while the investigation continues, preventing users from rolling out new versions during this period. According to the company’s status page, as of October 22 at 08:44 UTC, builds had been restored for Pro and Enterprise workspaces, though deployments remained delayed with many queued. Builds had not yet resumed for Hobby, Free, and Trial workspaces, with restoration planned to follow in that order.

Security teams managing services on Railway should treat all previously stored secrets as potentially exposed and prioritize credential rotation, particularly for any integrations tied to AI inference providers.