Railway Discloses Security Incident: Encrypted Environment Variables May Have Been Unauthorizedly Accessed

Railway's official blog has issued a security disclosure, stating that earlier today, unusual activity was detected in the system storing customer environment variables. Initial investigations suggest that an unauthorized third party may have accessed encrypted environment variables, some of which have since been decrypted. These variables may have contained API keys, database credentials, and image repository credentials.
Railway stated that this incident may be part of a recent series of attacks targeting platform companies, with the aim of compromising AI inference service providers. The company has notified its upstream service providers to proactively revoke all keys. The current impact is preliminarily assessed to be limited to some users; however, the official recommendation is for all users to immediately rotate all environment variables (including API keys) and private image repository credentials stored in Railway, and to review relevant service logs for any anomalies.
During the investigation, Railway has paused all deployments, and users cannot release new versions until recovery is built. The company stated that it will directly contact affected customers via email once impacted accounts are confirmed, and will provide updates on progress at status.railway.com.