Railway urges users to revoke API keys after cyberattack exposes customer secrets
Railway detected unauthorized access to systems storing customer environment variables on October 21, revealing that attackers may have decrypted sensitive data such as API keys, database passwords, and private registry credentials. While the company believes only some customers were affected, it advised all users to replace credentials and monitor for suspicious activity. Railway suspects the breach may be part of a coordinated campaign targeting platform companies to compromise AI inference providers, and has notified upstream services including OpenAI, Anthropic, and GitHub. The company has not disclosed the attack vector, customer impact scale, or which specific credentials were exposed.
Key points
- Unauthorized access to customer environment variables containing API keys and credentials
- Attack suspected to be part of broader campaign targeting AI inference providers
- All Railway users advised to replace credentials and check for suspicious activity
- Company notified OpenAI, Anthropic, GitHub to revoke potentially compromised keys
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. MediaNama did the reporting; read the original for the full story.
Read the full story at MediaNama
