Railway breach exposes customer secrets and urges credential rotation

Platform-as-a-Service provider Railway disclosed on Wednesday that an unauthorized party may have accessed customer environment variables. The company confirmed that while most data remained encrypted, some decrypted contents were potentially exposed, affecting a subset of users.

What happened

Railway detected anomalous activity in the systems responsible for storing customer environment variables. Upon investigation, the team found that an intruder had gained access to these storage systems. Although the variables are typically encrypted at rest, the attacker managed to obtain the decrypted contents in some instances. The company stated that the impact is limited to a specific subset of users but did not provide an exact count of those affected.

In response to the breach, Railway has rotated all its internal bucket credentials and invalidated existing API tokens. The provider also notified upstream services to proactively revoke keys, aiming to prevent further abuse of any stolen credentials. Builds for Pro and Enterprise workspaces have been restored, allowing customers to deploy new credentials, while support for Hobby, Free, and Trial tiers is being re-enabled gradually. Users continue to experience longer wait times and occasional build failures as the platform stabilizes.

Security researcher Taylor Monahan noted that the incident extended beyond standard API keys. Attackers reportedly drained cryptocurrency wallets where private keys had been stored within Railway’s environment variables. The first known theft transaction occurred at 7:36 p.m., at least two hours before Railway officially disclosed the incident. This timeline suggests that threat actors were actively exploiting the access window before the public notification.

Key details

• Railway confirmed unauthorized access to systems storing customer environment variables on Wednesday.
• Some decrypted contents of environment variables were accessed, though most remained encrypted.
• Cryptocurrency wallets with private keys stored in variables were drained by attackers.
• Railway has rotated all bucket credentials and invalidated API tokens to secure the platform.
• Builds are currently available for Pro and Enterprise users, with other tiers pending restoration.
• Upstream providers were notified to revoke keys proactively to prevent misuse.

Background

Environment variables are key-value pairs used by applications to store configuration settings and sensitive data, such as database passwords, API keys, and feature flags. Instead of hard-coding these secrets directly into the source code, developers inject them at the operating system or container level. This practice is standard in modern DevOps workflows because it separates configuration from code, making applications more portable and secure. However, if the platform managing these variables is compromised, all stored secrets become vulnerable.

The broader context of this incident involves a rising trend known as LLMjacking, where attackers compromise cloud environments to run Large Language Models at the victim's expense. Recent reports from Wiz and Symantec highlight how threat actors use phishing and excessive privileges to hijack cloud resources. While Railway has not confirmed if its stolen keys were used for AI inference, the value of API keys in this emerging threat landscape makes them a prime target for automated cybercrime operations.

Why it matters

For teams that self-host or manage their own infrastructure, this incident underscores the risks of relying on third-party platforms for secret management. Even when data is encrypted at rest, the decryption process creates a window of vulnerability if the host system is breached. Developers often treat environment variables as a secure vault, but this event demonstrates that they are only as secure as the platform holding them. If a PaaS provider is compromised, every API key, database credential, and private key stored there is potentially exposed.

The connection to cryptocurrency theft and potential AI resource abuse highlights the financial motivation behind these attacks. Attackers are not just looking for data exfiltration; they are seeking immediate monetary gain or free compute resources. For IT leads and DevOps engineers, this means that credential hygiene is no longer just a best practice but a critical defense mechanism. The delay between the initial theft and the public disclosure further emphasizes the need for independent monitoring and log review, as reliance on vendor notifications may leave gaps in response time.

What you can do

• Rotate all environment variables and API keys stored in Railway immediately.
• Review service logs for unusual activity or unauthorized access attempts.
• Update private registry credentials to ensure secure image pulls.
• Avoid storing high-value secrets like cryptocurrency private keys in environment variables.
• Monitor upstream services for any signs of key misuse or unexpected billing spikes.
• Consider using dedicated secret management tools rather than platform-native storage for critical assets.