Railway Pauses Operations as Attackers Decrypt Customer API Keys, Urges Credential Rotation

Railway, a cloud platform serving over 2 million developers, disclosed a significant security breach on October 22 after detecting unauthorized access to encrypted environment variables storing API keys and database credentials. The company said that hackers gained access to encrypted secrets and in some cases successfully decrypted them, potentially exposing credentials for services including Anthropic, OpenAI, databases, and cloud providers.