Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack

Railway, which lets customers build and host apps on its cloud platform, said in a blog post Wednesday that unidentified hackers "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." Those variables typically hold passwords and API keys that apps use to reach databases and other services.

Railway said the breach appears limited to a "subset of users" but told "all users" to revoke and rotate their keys. It also paused customer deployments during the investigation. It did not say how many users were affected or what caused the incident.

The company said the breach was likely part of a broader campaign against platforms "with the aim of compromising AI inference providers." Earlier this week, the open-source AI coding tool OpenCode said hackers took more than 1% of its customers' API keys and other secrets in a similar attack.