Understand this story
Developer platform Railway required all customers to rotate all keys after intruders decrypted some stored credentials. The affected environment variables include database passwords, cloud keys, and model API keys; holders could log in as owners. Railway said only some users may be affected, but it froze all deployments on its own and reset bucket keys and GitHub tokens. On October 21, Railway discovered anomalous activity in the system storing customer environment variables, saying an unauthorized third party may have accessed encrypted environment variables and decrypted some of them. Railway believes the attack may be part of a recent series of attacks targeting platform companies with the aim of compromising AI inference providers, and has notified upstream vendors to revoke potentially leaked keys. On October 23, its builds and deployments were restored, but new user registration remains suspended.
AI-generated from public reports
Latest development · Report
Railway suffers cyberattack leaking customer keys, asks users to change API keysDevelopments
1 confirmed developments
- Source:Rohan Paul
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 23
MediaNama
Railway suffers cyberattack leaking customer keys, asks users to change API keys
Cloud hosting platform Railway discovered abnormal activity on October 21 in the system storing customer environment variables, stating that an unauthorized third party may have accessed encrypted environment variables and decrypted some of them, and has advised all users to change credentials such as API keys. Railway believes the attack may be part of a recent series of attacks targeting platform companies with the aim of breaching AI inference service providers, and has notified upstream suppliers to revoke potentially leaked keys. The company also released security guidance for OpenAI, Anthropic and GitHub users, advising them to delete potentially exposed API keys, generate new keys and check usage records; on October 23 its builds and deployments had recovered, but new user registration remained suspended.
Oct 22
@mark_kRelated discussion
@mark_k joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
Rohan Paul
Railway requires all customers to rotate keys after intrusion
Developer platform Railway is requiring all customers to rotate all keys after intruders decrypted some stored credentials. These environment variables include database passwords, cloud keys, and model API keys; holders could log in as the owner. Railway said only some users may be affected, but it froze all deployments itself and reset bucket keys and GitHub tokens, while linking this intrusion to a series of attacks targeting AI inference service platforms and asking the relevant providers to revoke keys. A few days earlier, OpenCode attributed a leak to a distillation attack, which may have exposed OpenAI, Anthropic, and Google keys saved by 1.4% of Console users.
Heat trend for this story
- Current
- 6
- Period peak
- 21 Oct 23 17:00
- 24-hour change
- -64%
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.