Developer platform Railway detected anomalous activity in the systems storing customer environment variables and said an unauthorized party may have accessed encrypted variables and some decrypted contents for a subset of users. Researcher Taylor Monahan traced wallet drains to private keys stored on Railway. Railway rotated bucket credentials, invalidated tokens and told all users to rotate every secret. Update Oct 23: Railway says the intruders were after stored AI provider API keys to run model-distillation jobs; up to 100,000 workspaces may have been exposed.
What to do: Rotate every AI provider key that was stored on Railway and set spend limits on those keys. Railway preliminary report (Oct 22): "at most 1.85% of all workspaces had some environment variables potentially compromised," about 100,000 workspaces. Attackers were "attempting to obtain AI provider API keys to perform distillation attacks." Attack window Oct 20 13:58 UTC to Oct 22 03:32 UTC.
AI angle: Attackers wanted AI API keys for model distillation; Railway also says uncensored models and large compute were used in the intrusion.
Railway just paused all deployments after a security breach that may have exposed customer secrets.
The preliminary report related to the October 21st Security Incident is now available. https://t.co/W903Qtv1DE
Railway published its preliminary report on the October breach, and it carries a twist. Railway is the cloud platform where thousands of developers host apps and databases. An attacker may have reached the vault holding
Railway told everyone to rotate their secrets on Oct 21, while builds were paused. Hobby and Free users couldn't deploy new keys for about 24 hours. I mapped the timeline and tested a rotation path that skips the deploy.
🚨 UPDATE: Railway says hackers targeted AI API keys to carry out model distillation attacks. Up to 100,000 workspaces may have been exposed. Attackers allegedly used uncensored AI models and massive compute resources to breach i
🚨🇺🇸 Railway says breach potentially exposed secrets in around 100,000 workspaces Cloud development platform Railway says an attacker gained access to internal systems and potentially exposed encrypted environment variables belonging to up to 1.85% of its workspaces, or roughly 1
Why this score
A subset of a large developer base (impact 2), active theft of keys and funds (exploitability 3), general sector (criticality 0). Raised to 6 on Oct 23 after Railway put the exposure at up to 100,000 workspaces.