Cloud hosting platform Railway disclosed on October 21 that it detected anomalous activity in systems that store customer environment variables. Its investigation so far indicates an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. Those variables can hold API keys and database and registry credentials.

Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and that it has asked those upstream providers to revoke keys proactively. While the impact may be limited to a subset of users, it recommends that all customers immediately rotate every environment variable and private registry credential stored on Railway and check logs for unusual activity.

All deployments were paused during the investigation, so customers could not roll out new versions until builds resumed. Railway says it will email affected customers directly; on October 22 it published follow-up guidance on checking for anomalous AWS and Google Cloud access.