Railway Suffers Security Breach Exposing Customer Secrets and API Keys
Railway has suspended app deployments following a security incident that exposed encrypted and decrypted environment variables, requiring users to immediately revoke and rotate all compromised credentials.
Railway suffered a security incident. Unauthorized third-party access hit internal systems storing customer environment variables. The breach exposed encrypted variables and, in some cases, retrieved decrypted content.
Impacted secrets include API keys, database credentials, and registry secrets. The incident is part of a broader campaign targeting platform providers to compromise AI inference services. Railway coordinated with upstream providers to revoke potentially exposed keys.
App deployments are currently suspended to prevent further exposure during remediation. You need to immediately revoke and reissue all environment variables, secrets, and credentials connected to external registries. Audit your service logs for anomalous activity or unauthorized access following the credential compromise.
Updates on infrastructure and build capabilities are available on the official status portal. Railway will release further information about the timeline for build restoration as it gathers additional facts.