Railway tells customers to replace credentials after suspicious access
Cloud hosting service Railway alerted users after detecting suspicious activity in systems that hold customer environment variables. The company said an unauthorized party may have accessed encrypted variables and decrypted some of them, so all users should replace secrets and credentials. Railway paused deployments during the investigation and began restoring builds for some workspace tiers.
Railway, a developer cloud platform with about 4.8 million users and over 16 million hosted services, uses environment variables to hold deployment settings and credentials. The company said suspicious activity this week may have exposed encrypted variables, with some decrypted contents obtained by an unauthorized party.
Railway advised every customer to rotate secrets, including private registry credentials, and review service logs. Deployments were paused during the probe; by October 22, builds had resumed for Pro and Enterprise workspaces, while Hobby, Free, and Trial remained pending. AI inference providers were also notified and told to revoke keys.
Developers and organizations relying on Railway may need to rotate API keys, database passwords, and registry credentials, which could disrupt deployments and integrations if missed. Because environment variables often grant access to backend systems, exposed secrets could increase risk of unauthorized data access or service misuse. The deployment pause may delay releases for some teams, while smaller or free-tier users may face longer recovery.