Railway urges users to reset credentials following security breach

Cloud hosting platform Railway confirmed on October 21 that an unauthorized third party may have accessed its systems and decrypted sensitive customer environment variables. The exposed data potentially includes API keys, database passwords, and private registry credentials, prompting the company to mandate a credentials reset for all users.

Railway has issued specific security guidance for customers utilizing third-party services such as OpenAI, Anthropic, and GitHub. The company advised users to rotate keys and audit account logs for unauthorized access or unexpected service charges. In response to the breach, Railway invalidated existing platform API tokens and began direct outreach to affected customers.

While the platform temporarily suspended new builds and deployments to mitigate risk, services have since been restored for existing accounts. New user registrations remain suspended. Railway stated it suspects the incident is part of a broader, ongoing campaign targeting technology platforms to compromise AI inference providers.

This security incident mirrors a similar breach reported earlier in the week by the AI coding tool OpenCode, where hackers targeted API secrets for AI model operations. Railway has yet to disclose the exact number of customers impacted or the specific mechanism the attackers used to gain entry, stating that further details will be provided in a forthcoming preliminary incident report.