Railway, the cloud platform developers use to deploy apps and databases, has confirmed that an outside attacker escalated privileges in its build infrastructure and decrypted some customer environment variables. The company says the attacker was hunting for AI provider API keys, and that up to 1.85% of all workspaces, roughly 100,000, may have had variables exposed.
No group has claimed the attack, and Railway has not said how the attacker first got in.
A two-day campaign inside the build system
According to Railway’s preliminary report, the intrusion ran from Oct 20 at 13:58 UTC to Oct 22 at 03:32 UTC, which is 9:58 AM ET on Oct 20 to 11:32 PM ET on Oct 21. On-call engineers were first paged for abnormal activity, then traced it to an attempted privilege escalation in the build infrastructure and halted build pipelines.
Railway says it fixed that first exploit the same afternoon. Roughly 2 hours later, new evidence showed the attacker could escalate access at larger scale across several systems at once, which is when the company says it realized it faced “a sustained and targeted campaign.” Railway describes the attacker as having had access to “abliterated models” (AI models with their safety refusals removed) and substantial computing resources.
From encrypted secrets to decrypted variables
The attacker first pulled secrets in encrypted form but could not read them. After Railway cut off some systems, the attacker reportedly obtained credentials for the company’s CI environment and decrypted artifacts that held additional API access. Railway later found database evidence of an unauthorized query of encrypted environment variables, some of which were decrypted using the stolen credentials.
Because of how its envelope encryption works, Railway says it cannot tell which specific keys were exposed. That uncertainty drove its response: rather than revoke only confirmed keys, it handed vendors every key stored on the platform.
What Railway says was targeted
Railway says the attacker was “attempting to obtain AI provider API keys to perform distillation attacks,” meaning copying the behavior of commercial AI models by querying them at scale. Logs from the attacker’s payloads reportedly showed the specific key names being searched for. Railway calls the incident part of a series of attacks on platform companies aimed at compromising AI inference providers, though it names no other victims.
That framing echoes other recent incidents. BreachNews reported that Zeabur was shutting down after a cyberattack exposed 3.2 million secrets, and that LiteLLM was hit by a second supply chain attack aimed at developer and AI credentials. No source ties the three incidents to the same actor.
What Railway has and has not ruled out
- User accounts: Railway says the attacker did not access them, though it still invalidated all API and project tokens.
- Source code: Not ruled out. Railway says it will confirm in its final forensic report.
- Running apps: They stayed online. Only new builds and deployments were paused.
- Customer databases: Railway has not said whether any were accessed, but advises removing public network access and rotating credentials.
Response and customer impact
Railway asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, Stripe and others to revoke keys. It also signed every user out, reset all storage bucket credentials and GitHub tokens, and paused new signups, which were still paused in its latest notices. Builds were down for roughly 2 days depending on plan, and the API was fully restored on Oct 22.
The fallout has been messy. On Oct 23, AI providers asked for a second batch of possibly affected keys, and because Railway could not filter by date, that batch included replacement keys customers had created after the incident. Railway says customers whose new keys were revoked should simply create another and redeploy, since a revocation does not mean the key was compromised. One customer posted publicly that a third party used their stored Gemini key, running up roughly €133 in charges.
What customers should do
Railway tells customers who signed up before Oct 21 to revoke and replace every sensitive environment variable and API key, update the Railway variable, and redeploy, since containers read variables only at startup. It also recommends:
- Reconnecting GitHub accounts and reviewing the Railway GitHub App’s repository access
- Creating new API and project tokens
- Redeploying services that reference bucket credentials and checking buckets for unexpected changes
- Reviewing AI provider usage and billing for activity the team did not generate
Railway has published guides for checking OpenAI, Anthropic and other provider usage, and for rotating PostgreSQL, MySQL, MongoDB and Redis credentials. It says it is not currently under attack and has promised a final report, and it has not said whether it received any ransom demand.
