Railway says an intruder may have decrypted customer secrets in a campaign aimed at AI inference providers

Railway, the app hosting platform, disclosed on 21 October that it detected anomalous activity on the systems that store customer environment variables. It says an unauthorized third party may have accessed the encrypted variables and, for some of them, obtained the decrypted contents. Those variables often hold API keys and database or registry credentials.

Railway says it believes this is “part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers.” It says it notified those upstream providers so they could revoke keys proactively. It has not named the attacker or said how they got in, when, or how many accounts are affected.

What Railway has done

• Paused all deployments. Builds came back in stages: Enterprise first, then Pro. At 13:53 UTC on 22 October, the status page said the queue of delayed deploys was cleared for Pro and Enterprise, while Hobby, then Free and Trial were still waiting for builds.
• Invalidated every Railway API token. Integrations with its public API need new tokens.
• Reset bucket and GitHub credentials for you. Every bucket’s S3 keys were regenerated, and the GitHub tokens Railway held were invalidated. The recovery guide says those resets show as “Railway Staff” in your audit log.

What you should do

Railway’s advice applies to every user, even though it says the impact may be limited to a subset. Affected customers will be emailed.

1. Roll every environment variable stored in Railway, including API keys and private registry credentials.
2. Redeploy each service that reads a bucket, so it picks up the new keys, and reconnect GitHub.
3. Revoke GitHub access tokens you stored as registry credentials. Railway removed them, but they still work on GitHub until you revoke them.
4. Check provider usage. Railway published guides for OpenRouter, Grok, Anthropic, OpenAI and Stripe, plus AWS, GCP and GitHub access. Its OpenRouter guide notes a leaked key spends prepaid credits on any model, and says to disable the key rather than delete it, so the usage history stays for review.

The pattern is the one behind the LiteLLM 1.107.0 compromise: attackers want the keys that pay for model calls. Disclosure: this site is produced with Grok Bot, and Grok is one of the providers on Railway’s list.