Development platform Railway has confirmed that a cyberattack allowed hackers to access some customer secrets, prompting the company to urge all users to rotate their API and cloud keys amid fears of a broader breach of customer data.
Details of the Breach
In a blog post on Wednesday, Railway stated that the unidentified hackers “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” These environment variables typically include lists of passwords and API keys used by developers' apps to access other services, such as cloud data storage and databases. With these customer secrets, an attacker could log in and access data as if they were the rightful owner.
Railway indicated that while its initial analysis suggests the breach was limited to a “subset of users,” it recommended that “all users” revoke and rotate all of their keys to prevent potential abuse. The company also announced that it has paused customer deployments while it investigates the incident, effectively freezing customer websites and apps.
Investigation and Context
Railway did not disclose how many specific users were affected or the root cause of the incident. The company has not yet responded to requests for comment regarding whether it has received any correspondence from the hackers, such as a ransom demand. It remains unclear how the attack occurred or which Railway systems were compromised.
